diff --git a/classes/cluster/virtual-mcp11-aio-ssl/.env b/classes/cluster/virtual-mcp11-aio-ssl/.env
new file mode 100644
index 0000000..e138b42
--- /dev/null
+++ b/classes/cluster/virtual-mcp11-aio-ssl/.env
@@ -0,0 +1 @@
+FORMULAS_SALT_MASTER+=(java openssh ntp nginx collectd sensu heka sphinx mysql galera grafana libvirt rsyslog glusterfs postfix xtrabackup freeipa prometheus telegraf elasticsearch kibana rundeck devops-portal libvirt rsyslog memcached rabbitmq apache keystone glance nova neutron cinder heat horizon ironic tftpd-hpa bind powerdns designate barbican iptables)
diff --git a/classes/cluster/virtual-mcp11-aio-ssl/infra/config.yml b/classes/cluster/virtual-mcp11-aio-ssl/infra/config.yml
new file mode 100644
index 0000000..0927924
--- /dev/null
+++ b/classes/cluster/virtual-mcp11-aio-ssl/infra/config.yml
@@ -0,0 +1,3 @@
+classes:
+  - cluster.virtual-mcp11-aio-ssl
+  - cluster.virtual-mcp11-aio.infra.config
diff --git a/classes/cluster/virtual-mcp11-aio-ssl/infra/init.yml b/classes/cluster/virtual-mcp11-aio-ssl/infra/init.yml
new file mode 100644
index 0000000..325f046
--- /dev/null
+++ b/classes/cluster/virtual-mcp11-aio-ssl/infra/init.yml
@@ -0,0 +1,17 @@
+classes:
+ - cluster.virtual-mcp11-aio.infra
+parameters:
+  _param:
+    salt_minion_ca_host: cfg01.${linux:system:domain}
+  salt:
+   minion:
+      cert:
+        internal_proxy:
+          host: ${_param:salt_minion_ca_host}
+          authority: ${_param:salt_minion_ca_authority}
+          common_name: internal_proxy
+          signing_policy: cert_open
+          alternative_names: IP:127.0.0.1,IP:${_param:cluster_local_address},IP:${_param:cluster_public_host},DNS:${linux:system:name},DNS:${linux:network:fqdn},DNS:${_param:cluster_local_address},DNS:${_param:cluster_public_host}
+          key_file: "/etc/ssl/private/internal_proxy.key"
+          cert_file: "/etc/ssl/certs/internal_proxy.crt"
+          all_file: "/etc/ssl/certs/internal_proxy-with-chain.crt"
diff --git a/classes/cluster/virtual-mcp11-aio-ssl/init.yml b/classes/cluster/virtual-mcp11-aio-ssl/init.yml
new file mode 100755
index 0000000..4000410
--- /dev/null
+++ b/classes/cluster/virtual-mcp11-aio-ssl/init.yml
@@ -0,0 +1,5 @@
+classes:
+- cluster.virtual-mcp11-aio-ssl.infra
+- cluster.virtual-mcp11-aio-ssl.openstack
+- cluster.virtual-mcp11-aio
+- cluster.overrides
diff --git a/classes/cluster/virtual-mcp11-aio-ssl/openstack/init.yml b/classes/cluster/virtual-mcp11-aio-ssl/openstack/init.yml
new file mode 100755
index 0000000..78d1d3a
--- /dev/null
+++ b/classes/cluster/virtual-mcp11-aio-ssl/openstack/init.yml
@@ -0,0 +1,104 @@
+classes:
+- system.apache.server.site.cinder
+# Enable proxy for services that are not under apache and
+# do not use apache wsgi template
+- system.apache.server.proxy.openstack.designate
+- system.apache.server.proxy.openstack.glance
+- system.apache.server.proxy.openstack.heat
+- system.apache.server.proxy.openstack.neutron
+- system.apache.server.proxy.openstack.nova
+- system.apache.server.proxy.openstack.placement
+- cluster.virtual-mcp11-aio.openstack
+parameters:
+  _param:
+    cluster_public_protocol: https
+    cluster_internal_protocol: https
+    keystone_service_protocol: ${_param:cluster_internal_protocol}
+    glance_service_protocol: ${_param:cluster_internal_protocol}
+    nova_service_protocol: ${_param:cluster_internal_protocol}
+    neutron_service_protocol: ${_param:cluster_internal_protocol}
+    heat_service_protocol: ${_param:cluster_internal_protocol}
+    cinder_service_protocol: ${_param:cluster_internal_protocol}
+    barbican_service_protocol: ${_param:cluster_internal_protocol}
+    designate_service_protocol: ${_param:cluster_internal_protocol}
+    apache_proxy_ssl:
+      enabled: true
+      engine: salt
+      authority: "${_param:salt_minion_ca_authority}"
+      key_file: "/etc/ssl/private/internal_proxy.key"
+      cert_file: "/etc/ssl/certs/internal_proxy.crt"
+      chain_file: "/etc/ssl/certs/internal_proxy-with-chain.crt"
+    apache_cinder_ssl: ${_param:apache_proxy_ssl}
+    apache_keystone_ssl: ${_param:apache_proxy_ssl}
+    apache_proxy_openstack_api_address: ${_param:cluster_public_host}
+    apache_proxy_openstack_keystone_host: 127.0.0.1
+    apache_proxy_openstack_nova_host: 127.0.0.1
+    apache_proxy_openstack_glance_host: 127.0.0.1
+    apache_proxy_openstack_neutron_host: 127.0.0.1
+    apache_proxy_openstack_heat_host: 127.0.0.1
+    apache_proxy_openstack_designate_host: 127.0.0.1
+    apache_proxy_openstack_placement_host: 127.0.0.1
+    apache_keystone_api_host: ${_param:single_address}
+  barbican:
+    server:
+      bind:
+        address: 127.0.0.1
+      identity:
+        protocol: https
+  neutron:
+    server:
+      bind:
+        address: 127.0.0.1
+      identity:
+        protocol: https
+  nova:
+    controller:
+      bind:
+         private_address: 127.0.0.1
+      identity:
+         protocol: https
+      network:
+         protocol: https
+      glance:
+         protocol: https
+      metadata:
+         bind:
+           address: ${_param:nova_service_host}
+
+  cinder:
+    controller:
+      identity:
+        protocol: https
+      glance:
+        protocol: https
+  horizon:
+    server:
+      secure: False
+      identity:
+        encryption: ssl
+  designate:
+    server:
+      identity:
+        protocol: https
+      bind:
+        api:
+          address: 127.0.0.1
+  glance:
+    server:
+      bind:
+        address: 127.0.0.1
+      identity:
+        protocol: https
+      registry:
+        protocol: https
+  heat:
+    server:
+      bind:
+        api:
+          address: 127.0.0.1
+        api_cfn:
+          address: 127.0.0.1
+        api_cloudwatch:
+          address: 127.0.0.1
+      identity:
+        protocol: https