diff --git a/hooks/nova_cc_hooks.py b/hooks/nova_cc_hooks.py
index ec8f968a..5b94babd 100755
--- a/hooks/nova_cc_hooks.py
+++ b/hooks/nova_cc_hooks.py
@@ -1102,7 +1102,8 @@ def update_nova_consoleauth_config():
         for rid in hookenv.relation_ids('ha'):
             hookenv.relation_set(rid, **data)
 
-        ch_host.service_resume('nova-consoleauth')
+        if not ch_utils.is_unit_paused_set():
+            ch_host.service_resume('nova-consoleauth')
 
 
 def nova_api_relation_joined(rid=None):
diff --git a/tox.ini b/tox.ini
index a759b529..730d7bfe 100644
--- a/tox.ini
+++ b/tox.ini
@@ -2,7 +2,7 @@
 # This file is managed centrally by release-tools and should not be modified
 # within individual charm repos.
 [tox]
-envlist = pep8,py27,py35,py36
+envlist = pep8,py27,py3{5,6}
 skipsdist = True
 skip_missing_interpreters = True
 
diff --git a/unit_tests/test_nova_cc_hooks.py b/unit_tests/test_nova_cc_hooks.py
index 70eb77a8..cd68464e 100644
--- a/unit_tests/test_nova_cc_hooks.py
+++ b/unit_tests/test_nova_cc_hooks.py
@@ -1104,6 +1104,7 @@ class NovaCCHooksTests(CharmTestCase):
         mock_resource_map.return_value = {}
         self.determine_packages.return_value = []
         mock_is_db_initialised.return_value = False
+        self.is_unit_paused_set.return_value = False
         self.config_value_changed.return_value = False
         self.os_release.return_value = 'diablo'
 
@@ -1137,6 +1138,55 @@ class NovaCCHooksTests(CharmTestCase):
 
         self.assertTrue(mock_update_aws_compat_svcs.called)
 
+    @patch.object(utils, 'get_shared_metadatasecret')
+    @patch.object(hooks, 'update_nrpe_config')
+    @patch.object(utils, 'resource_map')
+    @patch('hooks.nova_cc_utils.update_aws_compat_services')
+    @patch('hooks.nova_cc_utils.is_db_initialised')
+    @patch('charmhelpers.fetch.filter_installed_packages')
+    @patch('hooks.nova_cc_hooks.configure_https')
+    def test_config_changed_single_ca_paused(self,
+                                             mock_configure_https,
+                                             mock_filter_packages,
+                                             mock_is_db_initialised,
+                                             mock_update_aws_compat_svcs,
+                                             mock_resource_map,
+                                             mock_update_nrpe_config,
+                                             mock_get_shared_metadata_secret):
+        mock_resource_map.return_value = {}
+        self.determine_packages.return_value = []
+        mock_is_db_initialised.return_value = False
+        self.is_unit_paused_set.return_value = False
+        self.config_value_changed.return_value = False
+        self.os_release.return_value = 'diablo'
+        self.service_pause.side_effect = Exception
+
+        self.test_config.set('single-nova-consoleauth', False)
+        self.test_config.set('console-access-protocol', 'novnc')
+        rids = {'ha': ['ha:1']}
+
+        def f(r):
+            return rids.get(r, [])
+
+        self.relation_ids.side_effect = f
+        hooks.resolve_CONFIGS()
+        hooks.config_changed()
+        args = {
+            'delete_resources': ['vip_consoleauth', 'res_nova_consoleauth'],
+            'init_services': {},
+            'resources': {},
+            'resource_params': {},
+            'colocations': {}
+        }
+        print("in-test: self.relation_set:", self.relation_set)
+        self.relation_set.assert_has_calls([
+            call(v, **args) for v in rids['ha']
+        ])
+
+        self.assertEqual(self.service_pause.call_count, 0)
+        mock_filter_packages.assert_called_with([])
+        self.assertTrue(mock_update_aws_compat_svcs.called)
+
     @patch('hooks.nova_cc_utils.is_api_ready')
     def helper_test_nova_api_relation_joined(self, tgt, is_api_ready):
         is_api_ready.return_value = tgt