diff --git a/deployment/certs/certmonger-user-baremetal-puppet.yaml b/deployment/certs/certmonger-user-baremetal-puppet.yaml
index ba9a488a30..b5fb97bdae 100644
--- a/deployment/certs/certmonger-user-baremetal-puppet.yaml
+++ b/deployment/certs/certmonger-user-baremetal-puppet.yaml
@@ -62,12 +62,13 @@ outputs:
     value:
       service_name: certmonger_user
       config_settings:
-        if:
-          - internal_tls_enabled
-          - tripleo::certmonger::ca::crl::crl_source: {get_param: DefaultCRLURL}
-            certmonger_ca: {get_param: CertmongerCA}
-            certmonger_ca_vnc: {get_param: CertmongerVncCA}
-            certmonger_ca_qemu: {get_param: CertmongerQemuCA}
-          - {}
+        map_merge:
+          - certmonger_ca: {get_param: CertmongerCA}
+          - if:
+            - internal_tls_enabled
+            - tripleo::certmonger::ca::crl::crl_source: {get_param: DefaultCRLURL}
+              certmonger_ca_vnc: {get_param: CertmongerVncCA}
+              certmonger_ca_qemu: {get_param: CertmongerQemuCA}
+            - {}
       step_config: |
         include ::tripleo::profile::base::certmonger_user