diff --git a/panko/server/cluster.yml b/panko/server/cluster.yml
index 3a4cb65..9715456 100644
--- a/panko/server/cluster.yml
+++ b/panko/server/cluster.yml
@@ -4,6 +4,7 @@
 - system.apache.server.site.panko
 - system.haproxy.proxy.listen.openstack.panko
 - system.keepalived.cluster.instance.openstack_telemetry_vip
+- system.salt.minion.cert.mysql.clients.openstack.panko
 parameters:
   _param:
     panko_memcached_node01_address: ${_param:cluster_node01_address}
@@ -11,6 +12,8 @@
     panko_memcached_node03_address: ${_param:cluster_node03_address}
     # Keep events in database for 30 days
     panko_event_time_to_live: 2592000
+    openstack_mysql_x509_enabled: False
+    galera_ssl_enabled: False
   linux:
     system:
       cron:
@@ -25,6 +28,13 @@
         host: ${_param:openstack_control_address}
       database:
         host: ${_param:openstack_database_address}
+        x509:
+          enabled: ${_param:openstack_mysql_x509_enabled}
+          ca_file: ${_param:mysql_panko_ssl_ca_file}
+          key_file: ${_param:mysql_panko_client_ssl_key_file}
+          cert_file: ${_param:mysql_panko_client_ssl_cert_file}
+        ssl:
+          enabled: ${_param:galera_ssl_enabled}
       cache:
         engine: memcached
         members:
diff --git a/panko/server/single.yml b/panko/server/single.yml
index 4ba2787..cb1a449 100644
--- a/panko/server/single.yml
+++ b/panko/server/single.yml
@@ -1,10 +1,13 @@
 classes:
 - service.panko.server.single
 - system.apache.server.site.panko
+- system.salt.minion.cert.mysql.clients.openstack.panko
 parameters:
   _param:
     # Keep events in database for 30 days
     panko_event_time_to_live: 2592000
+    openstack_mysql_x509_enabled: False
+    galera_ssl_enabled: False
   linux:
     system:
       cron:
@@ -13,6 +16,14 @@
             enabled: true
   panko:
     server:
+      database:
+        x509:
+          enabled: ${_param:openstack_mysql_x509_enabled}
+          ca_file: ${_param:mysql_panko_ssl_ca_file}
+          key_file: ${_param:mysql_panko_client_ssl_key_file}
+          cert_file: ${_param:mysql_panko_client_ssl_cert_file}
+        ssl:
+          enabled: ${_param:galera_ssl_enabled}
       role: ${_param:openstack_node_role}
       event_time_to_live: ${_param:panko_event_time_to_live}
       # Check for expired events every day at 2 AM