diff --git a/README.rst b/README.rst
index 5c60cc2..5d21c9e 100644
--- a/README.rst
+++ b/README.rst
@@ -811,59 +811,51 @@
           virtual_host: '/openstack'
         ....
 
-Client-side RabbitMQ TLS configuration:
 
-|
+Configuring TLS communications
+------------------------------
 
-To enable TLS for oslo.messaging you need to provide the CA certificate.
 
-By default system-wide CA certs are used. Nothing should be specified except `ssl.enabled`.
+**Note:** by default system wide installed CA certs are used, so ``cacert_file`` param is optional, as well as ``cacert``.
+
+
+- **RabbitMQ TLS**
 
 .. code-block:: yaml
 
-  neutron:
-    server, gateway, compute:
-      ....
+ neutron:
+   server, gateway, compute:
       message_queue:
+        port: 5671
         ssl:
           enabled: True
+          (optional) cacert: cert body if the cacert_file does not exists
+          (optional) cacert_file: /etc/openstack/rabbitmq-ca.pem
+          (optional) version: TLSv1_2
 
 
-
-Use `cacert_file` option to specify the CA-cert file path explicitly:
+- **MySQL TLS**
 
 .. code-block:: yaml
 
-  neutron:
-    server, gateway, compute:
-      ....
-      message_queue:
+ neutron:
+   server:
+      database:
         ssl:
           enabled: True
-          cacert_file: /etc/ssl/rabbitmq-ca.pem
+          (optional) cacert: cert body if the cacert_file does not exists
+          (optional) cacert_file: /etc/openstack/mysql-ca.pem
 
-To manage content of the `cacert_file` use the `cacert` option:
+- **Openstack HTTPS API**
+
 
 .. code-block:: yaml
 
-  neutron:
-    server, gateway, compute:
-      ....
-      message_queue:
-        ssl:
-          enabled: True
-          cacert: |
-
-          -----BEGIN CERTIFICATE-----
-                    ...
-          -----END CERTIFICATE-------
-
-          cacert_file: /etc/openstack/rabbitmq-ca.pem
-
-
-Notice:
- * The `message_queue.port` is set to **5671** (AMQPS) by default if `ssl.enabled=True`.
- * Use `message_queue.ssl.version` if you need to specify protocol version. By default is TLSv1 for python < 2.7.9 and TLSv1_2 for version above.
+ neutron:
+   server:
+      identity:
+         protocol: https
+         (optional) cacert_file: /etc/openstack/proxy.pem
 
 
 Enable auditing filter, ie: CADF
diff --git a/neutron/files/newton/neutron-server.conf.Debian b/neutron/files/newton/neutron-server.conf.Debian
index 596413d..cf54c3e 100644
--- a/neutron/files/newton/neutron-server.conf.Debian
+++ b/neutron/files/newton/neutron-server.conf.Debian
@@ -873,8 +873,11 @@
 project_name = {{ server.identity.tenant }}
 username = {{ server.identity.user }}
 password = {{ server.identity.password }}
-auth_uri=http://{{ server.identity.host }}:5000
-auth_url=http://{{ server.identity.host }}:35357
+auth_uri={{ server.identity.get('protocol', 'http') }}://{{ server.identity.host }}:5000
+auth_url={{ server.identity.get('protocol', 'http') }}://{{ server.identity.host }}:35357
+{%- if server.identity.get('protocol', 'http') == 'https' %}
+cafile={{ server.identity.get('cacert_file', server.cacert_file) }}
+{%- endif %}
 {%- if server.cache is defined %}
 memcached_servers={%- for member in server.cache.members %}{{ member.host }}:11211{% if not loop.last %},{% endif %}{%- endfor %}
 {%- endif %}
@@ -1110,7 +1113,10 @@
 password = {{ server.compute.password }}
 username = {{ server.compute.user }}
 auth_type = password
-auth_url = http://{{ server.identity.host }}:35357
+auth_url = {{ server.identity.get('protocol', 'http') }}://{{ server.identity.host }}:35357
+{%- if server.identity.get('protocol', 'http') == 'https' %}
+cafile={{ server.identity.get('cacert_file', server.cacert_file) }}
+{%- endif %}
 
 # Authentication type to load (unknown value)
 # Deprecated group/name - [DEFAULT]/auth_plugin
diff --git a/neutron/files/ocata/neutron-server.conf.Debian b/neutron/files/ocata/neutron-server.conf.Debian
index ffe2a05..0875697 100644
--- a/neutron/files/ocata/neutron-server.conf.Debian
+++ b/neutron/files/ocata/neutron-server.conf.Debian
@@ -967,8 +967,11 @@
 project_name = {{ server.identity.tenant }}
 username = {{ server.identity.user }}
 password = {{ server.identity.password }}
-auth_uri=http://{{ server.identity.host }}:5000
-auth_url=http://{{ server.identity.host }}:35357
+auth_uri={{ server.identity.get('protocol', 'http') }}://{{ server.identity.host }}:5000
+auth_url={{ server.identity.get('protocol', 'http') }}://{{ server.identity.host }}:35357
+{%- if server.identity.get('protocol', 'http') == 'https' %}
+cafile={{ server.identity.get('cacert_file', server.cacert_file) }}
+{%- endif %}
 {%- if server.cache is defined %}
 memcached_servers={%- for member in server.cache.members %}{{ member.host }}:11211{% if not loop.last %},{% endif %}{%- endfor %}
 {%- endif %}
@@ -1257,7 +1260,10 @@
 password = {{ server.compute.password }}
 username = {{ server.compute.user }}
 auth_type = password
-auth_url = http://{{ server.identity.host }}:35357
+auth_url = {{ server.identity.get('protocol', 'http') }}://{{ server.identity.host }}:35357
+{%- if server.identity.get('protocol', 'http') == 'https' %}
+cafile={{ server.identity.get('cacert_file', server.cacert_file) }}
+{%- endif %}
 
 # Authentication type to load (string value)
 # Deprecated group/name - [nova]/auth_plugin