diff --git a/magnum/conductor/k8s_api.py b/magnum/conductor/k8s_api.py
index 4f1ba5eae5..a40b5f7c7e 100644
--- a/magnum/conductor/k8s_api.py
+++ b/magnum/conductor/k8s_api.py
@@ -67,12 +67,12 @@ class K8sAPI(apiv_api.ApivApi):
         :param bay: Bay object
         """
         magnum_cert_obj = cert_manager.get_backend().CertManager.get_cert(
-            bay.magnum_cert_ref)
+            bay.magnum_cert_ref, resource_ref=bay.uuid)
         self.cert_file = self._create_temp_file_with_content(
-            magnum_cert_obj.certificate)
+            magnum_cert_obj.get_certificate())
         private_key = serialization.load_pem_private_key(
-            magnum_cert_obj.private_key,
-            password=magnum_cert_obj.private_key_passphrase,
+            magnum_cert_obj.get_private_key(),
+            password=magnum_cert_obj.get_private_key_passphrase(),
             backend=default_backend(),
         )
         private_key = private_key.private_bytes(
@@ -82,9 +82,9 @@ class K8sAPI(apiv_api.ApivApi):
         self.key_file = self._create_temp_file_with_content(
             private_key)
         ca_cert_obj = cert_manager.get_backend().CertManager.get_cert(
-            bay.ca_cert_ref)
+            bay.ca_cert_ref, resource_ref=bay.uuid)
         self.ca_file = self._create_temp_file_with_content(
-            ca_cert_obj.certificate)
+            ca_cert_obj.get_certificate())
 
     def __del__(self):
         if self.ca_file:
diff --git a/magnum/tests/unit/conductor/test_k8s_api.py b/magnum/tests/unit/conductor/test_k8s_api.py
index f84d25965d..cf2a75d03a 100644
--- a/magnum/tests/unit/conductor/test_k8s_api.py
+++ b/magnum/tests/unit/conductor/test_k8s_api.py
@@ -45,10 +45,12 @@ class TestK8sAPI(base.TestCase):
     def _mock_named_file_creation(self, content):
         return TestK8sAPI.file_dict[content]
 
-    def _mock_cert_mgr_get_cert(self, cert_ref):
+    def _mock_cert_mgr_get_cert(self, cert_ref, **kwargs):
         cert_obj = mock.MagicMock()
-        cert_obj.certificate = TestK8sAPI.content_dict[cert_ref]['certificate']
-        cert_obj.private_key = TestK8sAPI.content_dict[cert_ref]['private_key']
+        cert_obj.get_certificate.return_value = (
+            TestK8sAPI.content_dict[cert_ref]['certificate'])
+        cert_obj.get_private_key.return_value = (
+            TestK8sAPI.content_dict[cert_ref]['private_key'])
         return cert_obj
 
     @patch('magnum.conductor.k8s_api.serialization.load_pem_private_key')