diff --git a/classes/cluster/virtual-mcp11-aio/infra/init.yml b/classes/cluster/virtual-mcp11-aio/infra/init.yml
index 46d0de0..d00a830 100644
--- a/classes/cluster/virtual-mcp11-aio/infra/init.yml
+++ b/classes/cluster/virtual-mcp11-aio/infra/init.yml
@@ -2,3 +2,7 @@
   _param:
     apt_mk_version: stable
     linux_system_purge_repos: false
+  salt:
+   minion:
+      trusted_ca_minions:
+        -  cfg01.${_param:cluster_domain}
diff --git a/classes/cluster/virtual-mcp11-aio/openstack/init.yml b/classes/cluster/virtual-mcp11-aio/openstack/init.yml
index 1279f66..a1e4c64 100755
--- a/classes/cluster/virtual-mcp11-aio/openstack/init.yml
+++ b/classes/cluster/virtual-mcp11-aio/openstack/init.yml
@@ -1,11 +1,15 @@
 classes:
+- system.salt.minion.cert.mysql.server
+- system.salt.minion.cert.rabbitmq_server
 - system.linux.system.lowmem
 - system.linux.system.repo.mcp.openstack
 - system.linux.system.repo.mcp.extra
 - system.linux.storage.loopback
+- service.rabbitmq.server.ssl
 - system.rabbitmq.server.vhost.openstack
 - system.keystone.server.wsgi
 - system.keystone.server.single
+- service.galera.ssl
 - service.galera.master.cluster
 - system.galera.server.database.cinder
 - system.galera.server.database.designate
@@ -138,6 +142,13 @@
           crypto_plugin: simple_crypto
           store_plugin: store_crypto
           global_default: True
+      database:
+        ssl:
+          enabled: True
+      message_queue:
+        port: 5671
+        ssl:
+          enabled: True
   neutron:
     server:
       api_workers: 2
@@ -145,11 +156,21 @@
       rpc_workers: 2
       message_queue:
         members: ~
+        port: 5671
+        ssl:
+          enabled: True
+      database:
+        ssl:
+          enabled: True
     gateway:
       metadata:
         workers: 2
       agent_mode: dvr_snat
       dvr: True
+      message_queue:
+        port: 5671
+        ssl:
+          enabled: True
   nova:
     compute:
       barbican:
@@ -161,17 +182,42 @@
         tenant: service
       cache:
         members: ~
+      message_queue:
+        port: 5671
+        ssl:
+          enabled: True
     controller:
       barbican:
         enabled: ${_param:barbican_integration_enabled}
       vncproxy_url: http://${_param:single_address}:6080
+      database:
+        ssl:
+          enabled: True
+      message_queue:
+        port: 5671
+        ssl:
+          enabled: True
   cinder:
     controller:
       barbican:
         enabled: ${_param:barbican_integration_enabled}
+      database:
+        ssl:
+          enabled: True
+      message_queue:
+        port: 5671
+        ssl:
+          enabled: True
     volume:
       cache:
         members: ~
+      database:
+        ssl:
+          enabled: True
+      message_queue:
+        port: 5671
+        ssl:
+          enabled: True
   horizon:
     server:
       secure: False
@@ -179,9 +225,41 @@
     server:
       quota:
         zones: ${_param:designate_quota_zones}
+      database:
+        ssl:
+          enabled: True
+      message_queue:
+        port: 5671
+        ssl:
+          enabled: True
     worker:
       enabled: ${_param:designate_worker_enabled}
   glance:
     server:
       barbican:
         enabled: ${_param:barbican_integration_enabled}
+      database:
+        ssl:
+          enabled: True
+      message_queue:
+        port: 5671
+        ssl:
+          enabled: True
+  keystone:
+    server:
+      database:
+        ssl:
+          enabled: True
+      message_queue:
+        port: 5671
+        ssl:
+          enabled: True
+  heat:
+    server:
+      database:
+        ssl:
+          enabled: True
+      message_queue:
+        port: 5671
+        ssl:
+          enabled: True