diff --git a/environments/enable-tls.yaml b/environments/enable-tls.yaml
index 290d2011a2..a3f39ebe70 100644
--- a/environments/enable-tls.yaml
+++ b/environments/enable-tls.yaml
@@ -1,58 +1,9 @@
+# Use this environment to pass in certificates for SSL deployments.
+# For these values to take effect, one of the tls-endpoints-*.yaml environments
+# must also be used.
 parameter_defaults:
   SSLCertificate: |
     The contents of your certificate go here
   SSLIntermediateCertificate: ''
   SSLKey: |
     The contents of the private key go here
-  EndpointMap:
-    AodhAdmin: {protocol: 'http', port: '8042', host: 'IP_ADDRESS'}
-    AodhInternal: {protocol: 'http', port: '8042', host: 'IP_ADDRESS'}
-    AodhPublic: {protocol: 'https', port: '13042', host: 'CLOUDNAME'}
-    CeilometerAdmin: {protocol: 'http', port: '8777', host: 'IP_ADDRESS'}
-    CeilometerInternal: {protocol: 'http', port: '8777', host: 'IP_ADDRESS'}
-    CeilometerPublic: {protocol: 'https', port: '13777', host: 'CLOUDNAME'}
-    CinderAdmin: {protocol: 'http', port: '8776', host: 'IP_ADDRESS'}
-    CinderInternal: {protocol: 'http', port: '8776', host: 'IP_ADDRESS'}
-    CinderPublic: {protocol: 'https', port: '13776', host: 'CLOUDNAME'}
-    GlanceAdmin: {protocol: 'http', port: '9292', host: 'IP_ADDRESS'}
-    GlanceInternal: {protocol: 'http', port: '9292', host: 'IP_ADDRESS'}
-    GlancePublic: {protocol: 'https', port: '13292', host: 'CLOUDNAME'}
-    GlanceRegistryInternal: {protocol: 'http', port: '9191', host: 'IP_ADDRESS'}
-    GnocchiAdmin: {protocol: 'http', port: '8041', host: 'IP_ADDRESS'}
-    GnocchiInternal: {protocol: 'http', port: '8041', host: 'IP_ADDRESS'}
-    GnocchiPublic: {protocol: 'https', port: '13041', host: 'CLOUDNAME'}
-    HeatAdmin: {protocol: 'http', port: '8004', host: 'IP_ADDRESS'}
-    HeatInternal: {protocol: 'http', port: '8004', host: 'IP_ADDRESS'}
-    HeatPublic: {protocol: 'https', port: '13004', host: 'CLOUDNAME'}
-    HeatCfnAdmin: {protocol: 'http', port: '8000', host: 'IP_ADDRESS'}
-    HeatCfnInternal: {protocol: 'http', port: '8000', host: 'IP_ADDRESS'}
-    HeatCfnPublic: {protocol: 'https', port: '13005', host: 'CLOUDNAME'}
-    HorizonPublic: {protocol: 'https', port: '443', host: 'CLOUDNAME'}
-    IronicAdmin: {protocol: 'http', port: '6385', host: 'IP_ADDRESS'}
-    IronicInternal: {protocol: 'http', port: '6385', host: 'IP_ADDRESS'}
-    IronicPublic: {protocol: 'https', port: '13385', host: 'CLOUDNAME'}
-    KeystoneAdmin: {protocol: 'http', port: '35357', host: 'IP_ADDRESS'}
-    KeystoneInternal: {protocol: 'http', port: '5000', host: 'IP_ADDRESS'}
-    KeystonePublic: {protocol: 'https', port: '13000', host: 'CLOUDNAME'}
-    ManilaAdmin: {protocol: 'http', port: '8786', host: 'IP_ADDRESS'}
-    ManilaInternal: {protocol: 'http', port: '8786', host: 'IP_ADDRESS'}
-    ManilaPublic: {protocol: 'https', port: '13786', host: 'CLOUDNAME'}
-    MysqlInternal: {protocol: 'mysql+pymysql', port: '3306', host: 'IP_ADDRESS'}
-    NeutronAdmin: {protocol: 'http', port: '9696', host: 'IP_ADDRESS'}
-    NeutronInternal: {protocol: 'http', port: '9696', host: 'IP_ADDRESS'}
-    NeutronPublic: {protocol: 'https', port: '13696', host: 'CLOUDNAME'}
-    NovaAdmin: {protocol: 'http', port: '8774', host: 'IP_ADDRESS'}
-    NovaInternal: {protocol: 'http', port: '8774', host: 'IP_ADDRESS'}
-    NovaPublic: {protocol: 'https', port: '13774', host: 'CLOUDNAME'}
-    NovaVNCProxyAdmin: {protocol: 'http', port: '6080', host: 'IP_ADDRESS'}
-    NovaVNCProxyInternal: {protocol: 'http', port: '6080', host: 'IP_ADDRESS'}
-    NovaVNCProxyPublic: {protocol: 'https', port: '13080', host: 'CLOUDNAME'}
-    SaharaAdmin: {protocol: 'http', port: '8386', host: 'IP_ADDRESS'}
-    SaharaInternal: {protocol: 'http', port: '8386', host: 'IP_ADDRESS'}
-    SaharaPublic: {protocol: 'https', port: '13386', host: 'CLOUDNAME'}
-    SwiftAdmin: {protocol: 'http', port: '8080', host: 'IP_ADDRESS'}
-    SwiftInternal: {protocol: 'http', port: '8080', host: 'IP_ADDRESS'}
-    SwiftPublic: {protocol: 'https', port: '13808', host: 'CLOUDNAME'}
-
-resource_registry:
-  OS::TripleO::NodeTLSData: ../puppet/extraconfig/tls/tls-cert-inject.yaml
diff --git a/environments/tls-endpoints-public-dns.yaml b/environments/tls-endpoints-public-dns.yaml
new file mode 100644
index 0000000000..3629672a39
--- /dev/null
+++ b/environments/tls-endpoints-public-dns.yaml
@@ -0,0 +1,55 @@
+# Use this environment when deploying an SSL-enabled overcloud where the public
+# endpoint is a DNS name.
+parameter_defaults:
+  EndpointMap:
+    AodhAdmin: {protocol: 'http', port: '8042', host: 'IP_ADDRESS'}
+    AodhInternal: {protocol: 'http', port: '8042', host: 'IP_ADDRESS'}
+    AodhPublic: {protocol: 'https', port: '13042', host: 'CLOUDNAME'}
+    CeilometerAdmin: {protocol: 'http', port: '8777', host: 'IP_ADDRESS'}
+    CeilometerInternal: {protocol: 'http', port: '8777', host: 'IP_ADDRESS'}
+    CeilometerPublic: {protocol: 'https', port: '13777', host: 'CLOUDNAME'}
+    CinderAdmin: {protocol: 'http', port: '8776', host: 'IP_ADDRESS'}
+    CinderInternal: {protocol: 'http', port: '8776', host: 'IP_ADDRESS'}
+    CinderPublic: {protocol: 'https', port: '13776', host: 'CLOUDNAME'}
+    GlanceAdmin: {protocol: 'http', port: '9292', host: 'IP_ADDRESS'}
+    GlanceInternal: {protocol: 'http', port: '9292', host: 'IP_ADDRESS'}
+    GlancePublic: {protocol: 'https', port: '13292', host: 'CLOUDNAME'}
+    GlanceRegistryInternal: {protocol: 'http', port: '9191', host: 'IP_ADDRESS'}
+    GnocchiAdmin: {protocol: 'http', port: '8041', host: 'IP_ADDRESS'}
+    GnocchiInternal: {protocol: 'http', port: '8041', host: 'IP_ADDRESS'}
+    GnocchiPublic: {protocol: 'https', port: '13041', host: 'CLOUDNAME'}
+    HeatAdmin: {protocol: 'http', port: '8004', host: 'IP_ADDRESS'}
+    HeatInternal: {protocol: 'http', port: '8004', host: 'IP_ADDRESS'}
+    HeatPublic: {protocol: 'https', port: '13004', host: 'CLOUDNAME'}
+    HeatCfnAdmin: {protocol: 'http', port: '8000', host: 'IP_ADDRESS'}
+    HeatCfnInternal: {protocol: 'http', port: '8000', host: 'IP_ADDRESS'}
+    HeatCfnPublic: {protocol: 'https', port: '13005', host: 'CLOUDNAME'}
+    HorizonPublic: {protocol: 'https', port: '443', host: 'CLOUDNAME'}
+    IronicAdmin: {protocol: 'http', port: '6385', host: 'IP_ADDRESS'}
+    IronicInternal: {protocol: 'http', port: '6385', host: 'IP_ADDRESS'}
+    IronicPublic: {protocol: 'https', port: '13385', host: 'CLOUDNAME'}
+    KeystoneAdmin: {protocol: 'http', port: '35357', host: 'IP_ADDRESS'}
+    KeystoneInternal: {protocol: 'http', port: '5000', host: 'IP_ADDRESS'}
+    KeystonePublic: {protocol: 'https', port: '13000', host: 'CLOUDNAME'}
+    ManilaAdmin: {protocol: 'http', port: '8786', host: 'IP_ADDRESS'}
+    ManilaInternal: {protocol: 'http', port: '8786', host: 'IP_ADDRESS'}
+    ManilaPublic: {protocol: 'https', port: '13786', host: 'CLOUDNAME'}
+    MysqlInternal: {protocol: 'mysql+pymysql', port: '3306', host: 'IP_ADDRESS'}
+    NeutronAdmin: {protocol: 'http', port: '9696', host: 'IP_ADDRESS'}
+    NeutronInternal: {protocol: 'http', port: '9696', host: 'IP_ADDRESS'}
+    NeutronPublic: {protocol: 'https', port: '13696', host: 'CLOUDNAME'}
+    NovaAdmin: {protocol: 'http', port: '8774', host: 'IP_ADDRESS'}
+    NovaInternal: {protocol: 'http', port: '8774', host: 'IP_ADDRESS'}
+    NovaPublic: {protocol: 'https', port: '13774', host: 'CLOUDNAME'}
+    NovaVNCProxyAdmin: {protocol: 'http', port: '6080', host: 'IP_ADDRESS'}
+    NovaVNCProxyInternal: {protocol: 'http', port: '6080', host: 'IP_ADDRESS'}
+    NovaVNCProxyPublic: {protocol: 'https', port: '13080', host: 'CLOUDNAME'}
+    SaharaAdmin: {protocol: 'http', port: '8386', host: 'IP_ADDRESS'}
+    SaharaInternal: {protocol: 'http', port: '8386', host: 'IP_ADDRESS'}
+    SaharaPublic: {protocol: 'https', port: '13386', host: 'CLOUDNAME'}
+    SwiftAdmin: {protocol: 'http', port: '8080', host: 'IP_ADDRESS'}
+    SwiftInternal: {protocol: 'http', port: '8080', host: 'IP_ADDRESS'}
+    SwiftPublic: {protocol: 'https', port: '13808', host: 'CLOUDNAME'}
+
+resource_registry:
+  OS::TripleO::NodeTLSData: ../puppet/extraconfig/tls/tls-cert-inject.yaml
diff --git a/environments/tls-endpoints-public-ip.yaml b/environments/tls-endpoints-public-ip.yaml
new file mode 100644
index 0000000000..d3f07cda91
--- /dev/null
+++ b/environments/tls-endpoints-public-ip.yaml
@@ -0,0 +1,55 @@
+# Use this environment when deploying an SSL-enabled overcloud where the public
+# endpoint is an IP address.
+parameter_defaults:
+  EndpointMap:
+    AodhAdmin: {protocol: 'http', port: '8042', host: 'IP_ADDRESS'}
+    AodhInternal: {protocol: 'http', port: '8042', host: 'IP_ADDRESS'}
+    AodhPublic: {protocol: 'https', port: '13042', host: 'IP_ADDRESS'}
+    CeilometerAdmin: {protocol: 'http', port: '8777', host: 'IP_ADDRESS'}
+    CeilometerInternal: {protocol: 'http', port: '8777', host: 'IP_ADDRESS'}
+    CeilometerPublic: {protocol: 'https', port: '13777', host: 'IP_ADDRESS'}
+    CinderAdmin: {protocol: 'http', port: '8776', host: 'IP_ADDRESS'}
+    CinderInternal: {protocol: 'http', port: '8776', host: 'IP_ADDRESS'}
+    CinderPublic: {protocol: 'https', port: '13776', host: 'IP_ADDRESS'}
+    GlanceAdmin: {protocol: 'http', port: '9292', host: 'IP_ADDRESS'}
+    GlanceInternal: {protocol: 'http', port: '9292', host: 'IP_ADDRESS'}
+    GlancePublic: {protocol: 'https', port: '13292', host: 'IP_ADDRESS'}
+    GlanceRegistryInternal: {protocol: 'http', port: '9191', host: 'IP_ADDRESS'}
+    GnocchiAdmin: {protocol: 'http', port: '8041', host: 'IP_ADDRESS'}
+    GnocchiInternal: {protocol: 'http', port: '8041', host: 'IP_ADDRESS'}
+    GnocchiPublic: {protocol: 'https', port: '13041', host: 'IP_ADDRESS'}
+    HeatAdmin: {protocol: 'http', port: '8004', host: 'IP_ADDRESS'}
+    HeatInternal: {protocol: 'http', port: '8004', host: 'IP_ADDRESS'}
+    HeatPublic: {protocol: 'https', port: '13004', host: 'IP_ADDRESS'}
+    HeatCfnAdmin: {protocol: 'http', port: '8000', host: 'IP_ADDRESS'}
+    HeatCfnInternal: {protocol: 'http', port: '8000', host: 'IP_ADDRESS'}
+    HeatCfnPublic: {protocol: 'https', port: '13005', host: 'IP_ADDRESS'}
+    HorizonPublic: {protocol: 'https', port: '443', host: 'IP_ADDRESS'}
+    IronicAdmin: {protocol: 'http', port: '6385', host: 'IP_ADDRESS'}
+    IronicInternal: {protocol: 'http', port: '6385', host: 'IP_ADDRESS'}
+    IronicPublic: {protocol: 'https', port: '13385', host: 'IP_ADDRESS'}
+    KeystoneAdmin: {protocol: 'http', port: '35357', host: 'IP_ADDRESS'}
+    KeystoneInternal: {protocol: 'http', port: '5000', host: 'IP_ADDRESS'}
+    KeystonePublic: {protocol: 'https', port: '13000', host: 'IP_ADDRESS'}
+    ManilaAdmin: {protocol: 'http', port: '8786', host: 'IP_ADDRESS'}
+    ManilaInternal: {protocol: 'http', port: '8786', host: 'IP_ADDRESS'}
+    ManilaPublic: {protocol: 'https', port: '13786', host: 'IP_ADDRESS'}
+    MysqlInternal: {protocol: 'mysql+pymysql', port: '3306', host: 'IP_ADDRESS'}
+    NeutronAdmin: {protocol: 'http', port: '9696', host: 'IP_ADDRESS'}
+    NeutronInternal: {protocol: 'http', port: '9696', host: 'IP_ADDRESS'}
+    NeutronPublic: {protocol: 'https', port: '13696', host: 'IP_ADDRESS'}
+    NovaAdmin: {protocol: 'http', port: '8774', host: 'IP_ADDRESS'}
+    NovaInternal: {protocol: 'http', port: '8774', host: 'IP_ADDRESS'}
+    NovaPublic: {protocol: 'https', port: '13774', host: 'IP_ADDRESS'}
+    NovaVNCProxyAdmin: {protocol: 'http', port: '6080', host: 'IP_ADDRESS'}
+    NovaVNCProxyInternal: {protocol: 'http', port: '6080', host: 'IP_ADDRESS'}
+    NovaVNCProxyPublic: {protocol: 'https', port: '13080', host: 'IP_ADDRESS'}
+    SaharaAdmin: {protocol: 'http', port: '8386', host: 'IP_ADDRESS'}
+    SaharaInternal: {protocol: 'http', port: '8386', host: 'IP_ADDRESS'}
+    SaharaPublic: {protocol: 'https', port: '13386', host: 'IP_ADDRESS'}
+    SwiftAdmin: {protocol: 'http', port: '8080', host: 'IP_ADDRESS'}
+    SwiftInternal: {protocol: 'http', port: '8080', host: 'IP_ADDRESS'}
+    SwiftPublic: {protocol: 'https', port: '13808', host: 'IP_ADDRESS'}
+
+resource_registry:
+  OS::TripleO::NodeTLSData: ../puppet/extraconfig/tls/tls-cert-inject.yaml