diff --git a/test/cpp/interop/client.cc b/test/cpp/interop/client.cc
index dbe29395b4f..cb9b396beb5 100644
--- a/test/cpp/interop/client.cc
+++ b/test/cpp/interop/client.cc
@@ -46,7 +46,7 @@
 #include "test/cpp/util/test_config.h"
 
 DEFINE_bool(use_tls, false, "Whether to use tls.");
-DEFINE_bool(use_prod_roots, false, "True to use SSL roots for google");
+DEFINE_bool(use_test_ca, false, "False to use SSL roots for google");
 DEFINE_int32(server_port, 0, "Server port.");
 DEFINE_string(server_host, "127.0.0.1", "Server host to connect to");
 DEFINE_string(server_host_override, "foo.test.google.fr",
diff --git a/test/cpp/interop/client_helper.cc b/test/cpp/interop/client_helper.cc
index cbad21e318e..61b46d25aa0 100644
--- a/test/cpp/interop/client_helper.cc
+++ b/test/cpp/interop/client_helper.cc
@@ -52,7 +52,7 @@
 #include "test/cpp/util/create_test_channel.h"
 
 DECLARE_bool(use_tls);
-DECLARE_bool(use_prod_roots);
+DECLARE_bool(use_test_ca);
 DECLARE_int32(server_port);
 DECLARE_string(server_host);
 DECLARE_string(server_host_override);
@@ -102,7 +102,7 @@ std::shared_ptr<Channel> CreateChannelForTestCase(
     GPR_ASSERT(FLAGS_use_tls);
     creds = GoogleComputeEngineCredentials();
     return CreateTestChannel(host_port, FLAGS_server_host_override,
-                             FLAGS_use_tls, FLAGS_use_prod_roots, creds);
+                             FLAGS_use_tls, !FLAGS_use_test_ca, creds);
   } else if (test_case == "jwt_token_creds") {
     std::shared_ptr<Credentials> creds;
     GPR_ASSERT(FLAGS_use_tls);
@@ -111,15 +111,15 @@ std::shared_ptr<Channel> CreateChannelForTestCase(
     creds =
         ServiceAccountJWTAccessCredentials(json_key, token_lifetime.count());
     return CreateTestChannel(host_port, FLAGS_server_host_override,
-                             FLAGS_use_tls, FLAGS_use_prod_roots, creds);
+                             FLAGS_use_tls, !FLAGS_use_test_ca, creds);
   } else if (test_case == "oauth2_auth_token") {
     grpc::string raw_token = GetOauth2AccessToken();
     std::shared_ptr<Credentials> creds = AccessTokenCredentials(raw_token);
     return CreateTestChannel(host_port, FLAGS_server_host_override,
-                             FLAGS_use_tls, FLAGS_use_prod_roots, creds);
+                             FLAGS_use_tls, !FLAGS_use_test_ca, creds);
   } else {
     return CreateTestChannel(host_port, FLAGS_server_host_override,
-                             FLAGS_use_tls, FLAGS_use_prod_roots);
+                             FLAGS_use_tls, !FLAGS_use_test_ca);
   }
 }
 
diff --git a/tools/gce_setup/grpc_docker.sh b/tools/gce_setup/grpc_docker.sh
index fdb77363273..e50706ec74b 100755
--- a/tools/gce_setup/grpc_docker.sh
+++ b/tools/gce_setup/grpc_docker.sh
@@ -1477,7 +1477,7 @@ grpc_cloud_prod_auth_compute_engine_creds_gen_node_cmd() {
 #   cmd=$($grpc_gen_test_cmd $flags)
 grpc_interop_gen_cxx_cmd() {
     local cmd_prefix="sudo docker run grpc/cxx";
-    local test_script="/var/local/git/grpc/bins/opt/interop_client --use_tls";
+    local test_script="/var/local/git/grpc/bins/opt/interop_client --use_tls --use_test_ca";
     local the_cmd="$cmd_prefix $test_script $@";
     echo $the_cmd
 }
@@ -1489,7 +1489,7 @@ grpc_interop_gen_cxx_cmd() {
 #   cmd=$($grpc_gen_test_cmd $flags)
 grpc_cloud_prod_gen_cxx_cmd() {
     local cmd_prefix="sudo docker run grpc/cxx";
-    local test_script="/var/local/git/grpc/bins/opt/interop_client --use_tls --use_prod_roots";
+    local test_script="/var/local/git/grpc/bins/opt/interop_client --use_tls";
     local gfe_flags=$(_grpc_prod_gfe_flags)
     local the_cmd="$cmd_prefix $test_script $gfe_flags $@";
     echo $the_cmd
@@ -1502,7 +1502,7 @@ grpc_cloud_prod_gen_cxx_cmd() {
 #   cmd=$($grpc_gen_test_cmd $flags)
 grpc_cloud_prod_auth_service_account_creds_gen_cxx_cmd() {
     local cmd_prefix="sudo docker run grpc/cxx";
-    local test_script="/var/local/git/grpc/bins/opt/interop_client --use_tls --use_prod_roots";
+    local test_script="/var/local/git/grpc/bins/opt/interop_client --use_tls";
     local gfe_flags=$(_grpc_prod_gfe_flags)
     local added_gfe_flags=$(_grpc_svc_acc_test_flags)
     local the_cmd="$cmd_prefix $test_script $gfe_flags $added_gfe_flags $@";
@@ -1516,7 +1516,7 @@ grpc_cloud_prod_auth_service_account_creds_gen_cxx_cmd() {
 #   cmd=$($grpc_gen_test_cmd $flags)
 grpc_cloud_prod_auth_compute_engine_creds_gen_cxx_cmd() {
     local cmd_prefix="sudo docker run grpc/cxx";
-    local test_script="/var/local/git/grpc/bins/opt/interop_client --use_tls --use_prod_roots";
+    local test_script="/var/local/git/grpc/bins/opt/interop_client --use_tls";
     local gfe_flags=$(_grpc_prod_gfe_flags)
     local added_gfe_flags=$(_grpc_gce_test_flags)
     local the_cmd="$cmd_prefix $test_script $gfe_flags $added_gfe_flags $@";
@@ -1530,7 +1530,7 @@ grpc_cloud_prod_auth_compute_engine_creds_gen_cxx_cmd() {
 #   cmd=$($grpc_gen_test_cmd $flags)
 grpc_cloud_prod_auth_jwt_token_creds_gen_cxx_cmd() {
     local cmd_prefix="sudo docker run grpc/cxx";
-    local test_script="/var/local/git/grpc/bins/opt/interop_client --use_tls --use_prod_roots";
+    local test_script="/var/local/git/grpc/bins/opt/interop_client --use_tls";
     local gfe_flags=$(_grpc_prod_gfe_flags)
     local added_gfe_flags=$(_grpc_jwt_token_test_flags)
     local the_cmd="$cmd_prefix $test_script $gfe_flags $added_gfe_flags $@";
diff --git a/tools/run_tests/run_interop_tests.py b/tools/run_tests/run_interop_tests.py
index 45efa572f95..2ca57d5907e 100755
--- a/tools/run_tests/run_interop_tests.py
+++ b/tools/run_tests/run_interop_tests.py
@@ -62,7 +62,6 @@ _CLOUD_TO_CLOUD_BASE_ARGS = [
 _SSL_CERT_ENV = { 'SSL_CERT_FILE':'/usr/local/share/grpc/roots.pem' }
 
 # TODO(jtattermusch) unify usage of --use_tls and --use_tls=true
-# TODO(jtattermusch) unify usage of --use_prod_roots and --use_test_ca
 # TODO(jtattermusch) go uses --tls_ca_file instead of --use_test_ca
 
 
@@ -75,11 +74,11 @@ class CXXLanguage:
 
   def cloud_to_prod_args(self):
     return (self.client_cmdline_base + _CLOUD_TO_PROD_BASE_ARGS +
-            ['--use_tls=true','--use_prod_roots'])
+            ['--use_tls=true'])
 
   def cloud_to_cloud_args(self):
     return (self.client_cmdline_base + _CLOUD_TO_CLOUD_BASE_ARGS +
-            ['--use_tls=true'])
+            ['--use_tls=true', '--use_test_ca=true'])
 
   def cloud_to_prod_env(self):
     return {}