diff --git a/heat/_ssl/mysql.sls b/heat/_ssl/mysql.sls
index b38e7cb..a5730fb 100644
--- a/heat/_ssl/mysql.sls
+++ b/heat/_ssl/mysql.sls
@@ -1,5 +1,9 @@
 {%- from "heat/map.jinja" import server with context %}
 
+heat_ssl_mysql:
+  test.show_notification:
+    - text: "Running heat._ssl.mysql"
+
 {%- if server.database.get('x509',{}).get('enabled',False) %}
 
   {%- set ca_file=server.database.x509.ca_file %}
@@ -12,6 +16,8 @@
     - name: {{ ca_file }}
     - contents_pillar: heat:server:database:x509:cacert
     - mode: 444
+    - user: heat
+    - group: heat
     - makedirs: true
   {%- else %}
   file.exists:
@@ -24,6 +30,8 @@
     - name: {{ cert_file }}
     - contents_pillar: heat:server:database:x509:cert
     - mode: 440
+    - user: heat
+    - group: heat
     - makedirs: true
   {%- else %}
   file.exists:
@@ -36,12 +44,23 @@
     - name: {{ key_file }}
     - contents_pillar: heat:server:database:x509:key
     - mode: 400
+    - user: heat
+    - group: heat
     - makedirs: true
   {%- else %}
   file.exists:
     - name: {{ key_file }}
   {%- endif %}
 
+mysql_heat_ssl_x509_set_user_and_group:
+  file.managed:
+    - names:
+      - {{ ca_file }}
+      - {{ cert_file }}
+      - {{ key_file }}
+    - user: heat
+    - group: heat
+
 {% elif server.database.get('ssl',{}).get('enabled',False) %}
 mysql_ca_heat:
   {%- if server.database.ssl.cacert is defined %}
diff --git a/heat/server.sls b/heat/server.sls
index 0412c53..d169e9f 100644
--- a/heat/server.sls
+++ b/heat/server.sls
@@ -2,13 +2,9 @@
 
 {%- if server.enabled %}
 
-{%- set mysql_x509_ssl_enabled = server.database.get('x509',{}).get('enabled',False) or server.database.get('ssl',{}).get('enabled',False) %}
-
 include:
   - heat.db.offline_sync
-  {%- if mysql_x509_ssl_enabled %}
   - heat._ssl.mysql
-  {%- endif %}
 
 heat_server_packages:
   pkg.installed:
@@ -24,6 +20,7 @@
   - group: heat
   - require:
     - pkg: heat_server_packages
+    - sls: heat._ssl.mysql
   - require_in:
     - sls: heat.db.offline_sync
 
@@ -164,7 +161,7 @@
   - require:
     - file: /etc/heat/heat.conf
     - pkg: heat_server_packages
-  - require:
+    - sls: heat._ssl.mysql
     - sls: heat.db.offline_sync
 
 {%- endif %}
@@ -192,9 +189,7 @@
   {%- endif %}
   - require:
     - sls: heat.db.offline_sync
-    {%- if mysql_x509_ssl_enabled %}
     - sls: heat._ssl.mysql
-    {%- endif %}
   - watch:
     - file: /etc/heat/heat.conf
     - file: /etc/heat/api-paste.ini