diff --git a/keystone/common/openssl.py b/keystone/common/openssl.py
index 91a6db83dc..0bea6d8e71 100644
--- a/keystone/common/openssl.py
+++ b/keystone/common/openssl.py
@@ -68,7 +68,7 @@ class BaseCertificateConfigure(object):
             openssl_ver = environment.subprocess.check_output(  # the arguments
                 # are hardcoded and just check the openssl version
                 ['openssl', 'version'])
-            if "OpenSSL 0." in openssl_ver:
+            if b'OpenSSL 0.' in openssl_ver:
                 self.ssl_dictionary['default_md'] = 'sha1'
         except environment.subprocess.CalledProcessError:
             LOG.warning(_LW('Failed to invoke ``openssl version``, '
diff --git a/keystone/tests/unit/test_contrib_simple_cert.py b/keystone/tests/unit/test_contrib_simple_cert.py
index 2898bbaabf..111aa5c66b 100644
--- a/keystone/tests/unit/test_contrib_simple_cert.py
+++ b/keystone/tests/unit/test_contrib_simple_cert.py
@@ -34,7 +34,7 @@ class TestSimpleCert(BaseTestCase):
                                 expected_status=http_client.OK)
 
         self.assertEqual(content_type, response.content_type.lower())
-        self.assertIn('---BEGIN', response.body)
+        self.assertIn(b'---BEGIN', response.body)
 
         return response
 
diff --git a/tests-py3-blacklist.txt b/tests-py3-blacklist.txt
index a316e2a7db..d32e517eb6 100644
--- a/tests-py3-blacklist.txt
+++ b/tests-py3-blacklist.txt
@@ -3,8 +3,6 @@ keystone.tests.unit.common.test_notifications
 keystone.tests.unit.test_associate_project_endpoint_extension
 keystone.tests.unit.test_backend_ldap
 keystone.tests.unit.test_backend_ldap_pool
-keystone.tests.unit.test_cert_setup
-keystone.tests.unit.test_contrib_simple_cert
 keystone.tests.unit.test_hacking_checks
 keystone.tests.unit.test_ipv6
 keystone.tests.unit.test_v2