diff --git a/src/python/grpcio/grpc/_cython/_cygrpc/credentials.pyx.pxi b/src/python/grpcio/grpc/_cython/_cygrpc/credentials.pyx.pxi
index 63048e8da0d..ff523fb256c 100644
--- a/src/python/grpcio/grpc/_cython/_cygrpc/credentials.pyx.pxi
+++ b/src/python/grpcio/grpc/_cython/_cygrpc/credentials.pyx.pxi
@@ -129,6 +129,8 @@ cdef class SSLSessionCacheLRU:
 cdef class SSLChannelCredentials(ChannelCredentials):
 
   def __cinit__(self, pem_root_certificates, private_key, certificate_chain):
+    if pem_root_certificates is not None and not isinstance(pem_root_certificates, bytes):
+      raise TypeError('expected certificate to be bytes, got %s' % (type(pem_root_certificates)))
     self._pem_root_certificates = pem_root_certificates
     self._private_key = private_key
     self._certificate_chain = certificate_chain
diff --git a/src/python/grpcio_tests/tests/unit/_credentials_test.py b/src/python/grpcio_tests/tests/unit/_credentials_test.py
index be7378ecbce..187a6f03881 100644
--- a/src/python/grpcio_tests/tests/unit/_credentials_test.py
+++ b/src/python/grpcio_tests/tests/unit/_credentials_test.py
@@ -15,6 +15,7 @@
 
 import unittest
 import logging
+import six
 
 import grpc
 
@@ -53,6 +54,16 @@ class CredentialsTest(unittest.TestCase):
         self.assertIsInstance(channel_first_second_and_third,
                               grpc.ChannelCredentials)
 
+    @unittest.skipIf(six.PY2, 'only invalid in Python3')
+    def test_invalid_string_certificate(self):
+        self.assertRaises(
+            TypeError,
+            grpc.ssl_channel_credentials,
+            root_certificates='A Certificate',
+            private_key=None,
+            certificate_chain=None,
+        )
+
 
 if __name__ == '__main__':
     logging.basicConfig()