diff --git a/nova/compute.sls b/nova/compute.sls
index bc699cc..c088ccf 100644
--- a/nova/compute.sls
+++ b/nova/compute.sls
@@ -141,19 +141,23 @@
 {% endif %}
 
 {%- if compute.libvirt.get('tls',{}).get('enabled',False)  %}
-{%- set ca_file=compute.libvirt.tls.get('ca_file') %}
-{%- set key_file=compute.libvirt.tls.get('key_file') %}
-{%- set cert_file=compute.libvirt.tls.get('cert_file') %}
-{%- set client_key_file=compute.libvirt.tls.client.get('key_file') %}
-{%- set client_cert_file=compute.libvirt.tls.client.get('cert_file') %}
+{%- set ca_file=compute.libvirt.tls.ca_file %}
+{%- set key_file=compute.libvirt.tls.key_file %}
+{%- set cert_file=compute.libvirt.tls.cert_file %}
+{%- set client_key_file=compute.libvirt.tls.client.key_file %}
+{%- set client_cert_file=compute.libvirt.tls.client.cert_file %}
 
 libvirt_ca_nova_compute:
 {%- if compute.libvirt.tls.cacert is defined %}
   file.managed:
     - name: {{ ca_file }}
     - contents_pillar: nova:compute:libvirt:tls:cacert
-    - mode: 444
+    - mode: 644
+    - user: root
+    - group: nova
     - makedirs: true
+    - require:
+      - user: user_nova_bash
 {%- else %}
   file.exists:
    - name: {{ ca_file }}
@@ -164,8 +168,12 @@
   file.managed:
     - name: {{ cert_file }}
     - contents_pillar: nova:compute:libvirt:tls:cert
-    - mode: 440
+    - mode: 640
+    - user: root
+    - group: nova
     - makedirs: true
+    - require:
+      - user: user_nova_bash
 {%- else %}
   file.exists:
    - name: {{ cert_file }}
@@ -176,8 +184,12 @@
   file.managed:
     - name: {{ key_file }}
     - contents_pillar: nova:compute:libvirt:tls:key
-    - mode: 400
+    - mode: 640
+    - user: root
+    - group: nova
     - makedirs: true
+    - require:
+      - user: user_nova_bash
 {%- else %}
   file.exists:
    - name: {{ key_file }}
@@ -188,8 +200,12 @@
   file.managed:
     - name: {{ client_cert_file }}
     - contents_pillar: nova:compute:libvirt:tls:client:cert
-    - mode: 440
+    - mode: 640
+    - user: root
+    - group: nova
     - makedirs: true
+    - require:
+      - user: user_nova_bash
 {%- else %}
   file.exists:
    - name: {{ client_cert_file }}
@@ -200,27 +216,49 @@
   file.managed:
     - name: {{ client_key_file }}
     - contents_pillar: nova:compute:libvirt:tls:client:key
-    - mode: 400
+    - mode: 640
+    - user: root
+    - group: nova
     - makedirs: true
+    - require:
+      - user: user_nova_bash
 {%- else %}
   file.exists:
    - name: {{ client_key_file }}
 {%- endif %}
+
+libvirt_tls_set_user_and_group:
+  file.managed:
+    - names:
+      - {{ ca_file }}
+      - {{ cert_file }}
+      - {{ key_file }}
+      - {{ client_key_file }}
+      - {{ client_cert_file }}
+    - user: root
+    - group: nova
+    - require:
+      - user: user_nova_bash
+
 {%- endif %}
 
 {%- if compute.qemu.vnc.tls.get('enabled', False) %}
 
-{%- set ca_file=compute.qemu.vnc.tls.get('ca_file') %}
-{%- set key_file=compute.qemu.vnc.tls.get('key_file') %}
-{%- set cert_file=compute.qemu.vnc.tls.get('cert_file') %}
+{%- set ca_file=compute.qemu.vnc.tls.ca_file %}
+{%- set key_file=compute.qemu.vnc.tls.key_file %}
+{%- set cert_file=compute.qemu.vnc.tls.cert_file %}
 
 qemu_ca_nova_compute:
 {%- if compute.qemu.vnc.tls.cacert is defined %}
   file.managed:
     - name: {{ ca_file }}
     - contents_pillar: nova:compute:qemu:vnc:tls:cacert
-    - mode: 444
+    - mode: 644
+    - user: root
+    - group: libvirt-qemu
     - makedirs: true
+    - require:
+      - user: user_libvirt-qemu
 {%- else %}
   file.exists:
    - name: {{ ca_file }}
@@ -231,8 +269,12 @@
   file.managed:
     - name: {{ cert_file }}
     - contents_pillar: nova:compute:qemu:vnc:tls:cert
-    - mode: 440
+    - mode: 640
+    - user: root
+    - group: libvirt-qemu
     - makedirs: true
+    - require:
+      - user: user_libvirt-qemu
 {%- else %}
   file.exists:
    - name: {{ cert_file }}
@@ -243,13 +285,28 @@
   file.managed:
     - name: {{ key_file }}
     - contents_pillar: nova:compute:qemu:vnc:tls:key
-    - mode: 400
+    - mode: 640
+    - user: root
+    - group: libvirt-qemu
     - makedirs: true
+    - require:
+      - user: user_libvirt-qemu
 {%- else %}
   file.exists:
    - name: {{ key_file }}
 {%- endif %}
 
+qemu_tls_set_user_and_group:
+  file.managed:
+    - names:
+      - {{ ca_file }}
+      - {{ cert_file }}
+      - {{ key_file }}
+    - user: root
+    - group: libvirt-qemu
+    - require:
+      - user: user_libvirt-qemu
+
 {%- endif %}
 
 nova_compute_services:
diff --git a/nova/files/queens/nova-compute.conf.Debian b/nova/files/queens/nova-compute.conf.Debian
index d72bea4..f7179e4 100644
--- a/nova/files/queens/nova-compute.conf.Debian
+++ b/nova/files/queens/nova-compute.conf.Debian
@@ -4459,6 +4459,7 @@
 
 {%- set _data = compute.get('cinder', compute.get('identity', {})) %}
 {%- set auth_type = _data.get('auth_type', 'password') %}
+{%- if 'cacert_file' not in _data.keys() %}{% do _data.update({'cacert_file': compute.cacert_file}) %}{% endif %}
 {%- include "oslo_templates/files/queens/keystoneauth/_type_" + auth_type + ".conf" %}