diff --git a/nova/control/novncproxy/init.yml b/nova/control/novncproxy/init.yml
deleted file mode 100644
index 3cd04b8..0000000
--- a/nova/control/novncproxy/init.yml
+++ /dev/null
@@ -1,13 +0,0 @@
-classes:
-- system.salt.minion.cert.vnc.novncproxy_client
-parameters:
-  nova:
-    controller:
-      novncproxy:
-        tls:
-          enabled: True
-          key_file: ${_param:novncproxy_client_ssl_key_file}
-          cert_file: ${_param:novncproxy_client_ssl_cert_file}
-          ca_file: ${_param:novncproxy_ssl_ca_file}
-          all_file: ${_param:nova_websocketproxy_ssl_all_file}
-
diff --git a/nova/control/novncproxy/tls/init.yml b/nova/control/novncproxy/tls/init.yml
new file mode 100644
index 0000000..717d55e
--- /dev/null
+++ b/nova/control/novncproxy/tls/init.yml
@@ -0,0 +1,16 @@
+classes:
+- system.salt.minion.cert.vnc.novncproxy_client
+- system.salt.minion.cert.vnc.novncproxy_server
+parameters:
+  _param:
+    nova_vnc_tls_enabled: true
+  nova:
+    controller:
+      # Communication between noVNC proxy and client machine over TLS
+      novncproxy:
+        tls:
+          enabled: ${_param:nova_vnc_tls_enabled}
+        # Only for Queens. Communication between noVNC proxy service and QEMU
+        vencrypt:
+          tls:
+            enabled: ${_param:nova_vnc_tls_enabled}
diff --git a/salt/minion/ca/qemu-vnc_ca.yml b/salt/minion/ca/qemu-vnc_ca.yml
index 53778f1..a4583ad 100644
--- a/salt/minion/ca/qemu-vnc_ca.yml
+++ b/salt/minion/ca/qemu-vnc_ca.yml
@@ -21,7 +21,7 @@
           signing_policy:
             cert_server:
               type: v3_edge_cert_server
-              minions: 'cmp*'
+              minions: '*'
             cert_client:
               type: v3_edge_cert_client
               minions: 'ctl*'
diff --git a/salt/minion/cert/vnc/novncproxy_client.yml b/salt/minion/cert/vnc/novncproxy_client.yml
index 7f695eb..9641611 100644
--- a/salt/minion/cert/vnc/novncproxy_client.yml
+++ b/salt/minion/cert/vnc/novncproxy_client.yml
@@ -5,11 +5,10 @@
     novncproxy_client_ssl_key_file: /etc/pki/nova-novncproxy/client-key.pem
     novncproxy_client_ssl_cert_file: /etc/pki/nova-novncproxy/client-cert.pem
     novncproxy_ssl_ca_file: /etc/pki/nova-novncproxy/ca-cert.pem
-    nova_websocketproxy_ssl_all_file: /var/lib/nova/self.pem
   salt:
     minion:
       cert:
-        libvirt_novnc_client:
+        novncproxy_novnc_client:
           host: ${_param:salt_minion_ca_host}
           authority: ${_param:qemu_vnc_ca_authority}
           common_name: ${linux:system:name}.${_param:cluster_domain}
@@ -23,7 +22,6 @@
           key_file: ${_param:novncproxy_client_ssl_key_file}
           cert_file: ${_param:novncproxy_client_ssl_cert_file}
           ca_file: ${_param:novncproxy_ssl_ca_file}
-          all_file: ${_param:nova_websocketproxy_ssl_all_file}
           user: nova
           group: nova
           mode: 640
diff --git a/salt/minion/cert/vnc/novncproxy_server.yml b/salt/minion/cert/vnc/novncproxy_server.yml
new file mode 100644
index 0000000..20c24e2
--- /dev/null
+++ b/salt/minion/cert/vnc/novncproxy_server.yml
@@ -0,0 +1,29 @@
+classes:
+- system.salt.minion.cert.vnc
+parameters:
+  _param:
+    novncproxy_server_ssl_key_file: /etc/pki/nova-novncproxy/server-key.pem
+    novncproxy_server_ssl_cert_file: /etc/pki/nova-novncproxy/server-cert.pem
+    novncproxy_ssl_ca_file: /etc/pki/nova-novncproxy/ca-cert.pem
+  salt:
+    minion:
+      cert:
+        novncproxy_novnc_server:
+          host: ${_param:salt_minion_ca_host}
+          authority: ${_param:qemu_vnc_ca_authority}
+          common_name: ${linux:system:name}.${_param:cluster_domain}
+          signing_policy: cert_server
+          alternative_names: >
+            IP:${_param:cluster_local_address},
+            IP:${_param:cluster_vip_address},
+            DNS:${_param:cluster_local_address},
+            DNS:${linux:system:name},
+            DNS:${_param:cluster_vip_address},
+            DNS:${linux:network:fqdn}
+          key_usage: "digitalSignature,nonRepudiation,keyEncipherment"
+          key_file: ${_param:novncproxy_server_ssl_key_file}
+          cert_file: ${_param:novncproxy_server_ssl_cert_file}
+          ca_file: ${_param:novncproxy_ssl_ca_file}
+          user: nova
+          group: nova
+          mode: 640