diff --git a/nova/control/novncproxy/tls/init.yml b/nova/control/novncproxy/tls/init.yml
new file mode 100644
index 0000000..717d55e
--- /dev/null
+++ b/nova/control/novncproxy/tls/init.yml
@@ -0,0 +1,16 @@
+classes:
+- system.salt.minion.cert.vnc.novncproxy_client
+- system.salt.minion.cert.vnc.novncproxy_server
+parameters:
+  _param:
+    nova_vnc_tls_enabled: true
+  nova:
+    controller:
+      # Communication between noVNC proxy and client machine over TLS
+      novncproxy:
+        tls:
+          enabled: ${_param:nova_vnc_tls_enabled}
+        # Only for Queens. Communication between noVNC proxy service and QEMU
+        vencrypt:
+          tls:
+            enabled: ${_param:nova_vnc_tls_enabled}