diff --git a/xds/internal/client/bootstrap/bootstrap.go b/xds/internal/client/bootstrap/bootstrap.go
index 93e6d3e94..51ab98dee 100644
--- a/xds/internal/client/bootstrap/bootstrap.go
+++ b/xds/internal/client/bootstrap/bootstrap.go
@@ -118,8 +118,14 @@ type xdsServer struct {
 //      ],
 //      "server_features": [ ... ]
 //		"certificate_providers" : {
-//			"default": { default cert provider config },
-//			"foo": { config for provider foo }
+//			"default": {
+//				"plugin_name": "default-plugin-name",
+//				"config": { default plugin config in JSON }
+//			},
+//			"foo": {
+//				"plugin_name": "foo",
+//				"config": { foo plugin config in JSON }
+//			}
 //		}
 //    },
 //    "node": <JSON form of Node proto>
@@ -208,24 +214,28 @@ func NewConfig() (*Config, error) {
 			configs := make(map[string]CertProviderConfig)
 			getBuilder := internal.GetCertificateProviderBuilder.(func(string) certprovider.Builder)
 			for instance, data := range providerInstances {
-				var providerConfigs map[string]json.RawMessage
-				if err := json.Unmarshal(data, &providerConfigs); err != nil {
+				var nameAndConfig struct {
+					PluginName string          `json:"plugin_name"`
+					Config     json.RawMessage `json:"config"`
+				}
+				if err := json.Unmarshal(data, &nameAndConfig); err != nil {
 					return nil, fmt.Errorf("xds: json.Unmarshal(%v) for field %q failed during bootstrap: %v", string(v), instance, err)
 				}
-				for name, cfg := range providerConfigs {
-					parser := getBuilder(name)
-					if parser == nil {
-						// We ignore plugins that we do not know about.
-						continue
-					}
-					c, err := parser.ParseConfig(cfg)
-					if err != nil {
-						return nil, fmt.Errorf("xds: Config parsing for plugin %q failed: %v", name, err)
-					}
-					configs[instance] = CertProviderConfig{
-						Name:   name,
-						Config: c,
-					}
+
+				name := nameAndConfig.PluginName
+				parser := getBuilder(nameAndConfig.PluginName)
+				if parser == nil {
+					// We ignore plugins that we do not know about.
+					continue
+				}
+				cfg := nameAndConfig.Config
+				c, err := parser.ParseConfig(cfg)
+				if err != nil {
+					return nil, fmt.Errorf("xds: Config parsing for plugin %q failed: %v", name, err)
+				}
+				configs[instance] = CertProviderConfig{
+					Name:   name,
+					Config: c,
 				}
 			}
 			config.CertProviderConfigs = configs
diff --git a/xds/internal/client/bootstrap/bootstrap_test.go b/xds/internal/client/bootstrap/bootstrap_test.go
index 353bcd9eb..22665060b 100644
--- a/xds/internal/client/bootstrap/bootstrap_test.go
+++ b/xds/internal/client/bootstrap/bootstrap_test.go
@@ -564,10 +564,12 @@ func TestNewConfigWithCertificateProviders(t *testing.T) {
 			"server_features" : ["foo", "bar", "xds_v3"],
 			"certificate_providers": {
 				"unknownProviderInstance1": {
-					"foo1": "bar1"
+					"plugin_name": "foo",
+					"config": {"foo": "bar"}
 				},
 				"unknownProviderInstance2": {
-					"foo2": "bar2"
+					"plugin_name": "bar",
+					"config": {"foo": "bar"}
 				}
 			}
 		}`,
@@ -588,17 +590,12 @@ func TestNewConfigWithCertificateProviders(t *testing.T) {
 			"server_features" : ["foo", "bar", "xds_v3"],
 			"certificate_providers": {
 				"unknownProviderInstance": {
-					"foo": "bar"
-				},
-				"fakeProviderInstance": {
-					"fake-certificate-provider": {
-						"configKey": "configValue"
-					}
+					"plugin_name": "foo",
+					"config": {"foo": "bar"}
 				},
 				"fakeProviderInstanceBad": {
-					"fake-certificate-provider": {
-						"configKey": 666
-					}
+					"plugin_name": "fake-certificate-provider",
+					"config": {"configKey": 666}
 				}
 			}
 		}`,
@@ -619,12 +616,12 @@ func TestNewConfigWithCertificateProviders(t *testing.T) {
 			"server_features" : ["foo", "bar", "xds_v3"],
 			"certificate_providers": {
 				"unknownProviderInstance": {
-					"foo": "bar"
+					"plugin_name": "foo",
+					"config": {"foo": "bar"}
 				},
 				"fakeProviderInstance": {
-					"fake-certificate-provider": {
-						"configKey": "configValue"
-					}
+					"plugin_name": "fake-certificate-provider",
+					"config": {"configKey": "configValue"}
 				}
 			}
 		}`,
@@ -692,7 +689,7 @@ func TestNewConfigWithCertificateProviders(t *testing.T) {
 			}
 			c, err := NewConfig()
 			if (err != nil) != test.wantErr {
-				t.Fatalf("NewConfig() returned: %v, wantErr: %v", err, test.wantErr)
+				t.Fatalf("NewConfig() returned: (%+v, %v), wantErr: %v", c.CertProviderConfigs, err, test.wantErr)
 			}
 			if test.wantErr {
 				return