diff --git a/hooks/hooks.py b/hooks/hooks.py
index 3b1313b4..e88c633e 100755
--- a/hooks/hooks.py
+++ b/hooks/hooks.py
@@ -189,11 +189,16 @@ def setup_keystone_certs(unit=None, rid=None):
     import requests
     try:
         # Kilo and newer
-        from keystoneclient.exceptions import ConnectionRefused
+        from keystoneclient.exceptions import (
+            ConnectionRefused,
+            Forbidden
+        )
     except ImportError:
         # Juno and older
-        from keystoneclient.exceptions import ConnectionError as \
-            ConnectionRefused
+        from keystoneclient.exceptions import (
+            ConnectionError as ConnectionRefused,
+            Forbidden
+        )
 
     from keystoneclient.v2_0 import client
 
@@ -228,7 +233,7 @@ def setup_keystone_certs(unit=None, rid=None):
             # Juno and older
             ca_cert = requests.request('GET', auth_endpoint +
                                        '/certificates/ca').text
-    except (ConnectionRefused, requests.exceptions.ConnectionError):
+    except (ConnectionRefused, requests.exceptions.ConnectionError, Forbidden):
         log("Error connecting to keystone - skipping ca/signing cert setup",
             level=WARNING)
         return