diff --git a/nova/control/cluster.yml b/nova/control/cluster.yml
index 90a2bae..d202987 100644
--- a/nova/control/cluster.yml
+++ b/nova/control/cluster.yml
@@ -4,6 +4,7 @@
 - service.keepalived.cluster.single
 - system.haproxy.proxy.listen.openstack.nova
 - system.haproxy.proxy.listen.openstack.novnc
+- system.salt.minion.cert.mysql.clients.openstack.nova
 parameters:
   _param:
     nova_vncproxy_url: http://${_param:cluster_vip_address}:6080
@@ -12,6 +13,7 @@
     nova_disk_allocation_ratio: 1.0
     metadata_password: metadataPass
     cluster_internal_protocol: 'http'
+    openstack_mysql_x509_enabled: False
   linux:
     system:
       package:
@@ -44,6 +46,8 @@
         name: nova
         user: nova
         password: ${_param:mysql_nova_password}
+        x509:
+          enabled: ${_param:openstack_mysql_x509_enabled}
       identity:
         engine: keystone
         region: ${_param:openstack_region}
diff --git a/nova/control/single.yml b/nova/control/single.yml
index 4e3799b..4cc165d 100644
--- a/nova/control/single.yml
+++ b/nova/control/single.yml
@@ -1,8 +1,10 @@
 classes:
+- system.salt.minion.cert.mysql.clients.openstack.nova
 - service.nova.control.single
 parameters:
   _param:
     cluster_internal_protocol: 'http'
+    openstack_mysql_x509_enabled: False
   linux:
     system:
       package:
@@ -14,6 +16,8 @@
       role: ${_param:openstack_node_role}
       database:
         host: ${_param:single_address}
+        x509:
+          enabled: ${_param:openstack_mysql_x509_enabled}
       identity:
         protocol: ${_param:cluster_internal_protocol}
         region: ${_param:openstack_region}