diff --git a/packstack/plugins/apache_060.py b/packstack/plugins/apache_060.py
new file mode 100644
index 000000000..c50f95ebd
--- /dev/null
+++ b/packstack/plugins/apache_060.py
@@ -0,0 +1,47 @@
+# -*- coding: utf-8 -*-
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""
+Installs and configures Apache for all services using it
+"""
+
+from packstack.installer import utils
+
+from packstack.modules.ospluginutils import appendManifestFile
+from packstack.modules.ospluginutils import getManifestTemplate
+
+# ------------- Aodh Packstack Plugin Initialization --------------
+
+PLUGIN_NAME = "OS-Apache"
+PLUGIN_NAME_COLORED = utils.color_text(PLUGIN_NAME, 'blue')
+
+
+def initConfig(controller):
+    # No config needed
+    return
+
+
+def initSequences(controller):
+    steps = [{'title': 'Adding Apache manifest entries',
+              'functions': [create_manifest]}]
+    controller.addSequence("Setting up Apache", [], [],
+                           steps)
+
+# ------------------------- step functions -------------------------
+
+
+def create_manifest(config, messages):
+    manifestfile = "%s_apache.pp" % config['CONFIG_CONTROLLER_HOST']
+    manifestdata = getManifestTemplate("apache")
+    appendManifestFile(manifestfile, manifestdata, 'apache')
diff --git a/packstack/plugins/dashboard_500.py b/packstack/plugins/dashboard_500.py
index 37bd065a0..6cdcc7633 100644
--- a/packstack/plugins/dashboard_500.py
+++ b/packstack/plugins/dashboard_500.py
@@ -208,6 +208,7 @@ def create_manifest(config, messages):
             config["CONFIG_HORIZON_NEUTRON_VPN"] = True
 
     manifestdata = getManifestTemplate("horizon")
+    manifestdata += getManifestTemplate("apache_ports")
     appendManifestFile(manifestfile, manifestdata)
 
     msg = ("To access the OpenStack Dashboard browse to %s://%s/dashboard .\n"
diff --git a/packstack/plugins/keystone_100.py b/packstack/plugins/keystone_100.py
index b5895fe07..fac4c0762 100644
--- a/packstack/plugins/keystone_100.py
+++ b/packstack/plugins/keystone_100.py
@@ -780,6 +780,8 @@ def munge_ldap_config_params(config, messages):
 def create_manifest(config, messages):
     manifestfile = "%s_keystone.pp" % config['CONFIG_CONTROLLER_HOST']
     manifestdata = getManifestTemplate("keystone")
+    if config['CONFIG_KEYSTONE_SERVICE_NAME'] == 'httpd':
+        manifestdata += getManifestTemplate("apache_ports")
 
     if config['CONFIG_IP_VERSION'] == 'ipv6':
         host = config['CONFIG_CONTROLLER_HOST']
diff --git a/packstack/plugins/nagios_910.py b/packstack/plugins/nagios_910.py
index 9c9c592eb..bac1fc654 100644
--- a/packstack/plugins/nagios_910.py
+++ b/packstack/plugins/nagios_910.py
@@ -94,6 +94,7 @@ def create_manifest(config, messages):
 
     manifestfile = "%s_nagios.pp" % config['CONFIG_CONTROLLER_HOST']
     manifestdata = getManifestTemplate("nagios_server")
+    manifestdata += getManifestTemplate("apache_ports")
     appendManifestFile(manifestfile, manifestdata)
 
 
diff --git a/packstack/puppet/templates/apache.pp b/packstack/puppet/templates/apache.pp
new file mode 100644
index 000000000..85b3bd3fd
--- /dev/null
+++ b/packstack/puppet/templates/apache.pp
@@ -0,0 +1,9 @@
+include ::apache
+
+if hiera('CONFIG_HORIZON_SSL')  == 'y' {
+  package { 'mod_ssl':
+    ensure => installed,
+  }
+
+  Package['mod_ssl'] -> Class['::apache']
+}
diff --git a/packstack/puppet/templates/apache_ports.pp b/packstack/puppet/templates/apache_ports.pp
new file mode 100644
index 000000000..3de4029a0
--- /dev/null
+++ b/packstack/puppet/templates/apache_ports.pp
@@ -0,0 +1,9 @@
+if hiera('CONFIG_HORIZON_SSL')  == 'y' {
+  apache::listen { '443': }
+}
+
+if hiera('CONFIG_KEYSTONE_SERVICE_NAME') == 'httpd' {
+  apache::listen { '5000': }
+  apache::listen { '35357': }
+}
+
diff --git a/packstack/puppet/templates/horizon.pp b/packstack/puppet/templates/horizon.pp
index c55740c61..e7359413a 100644
--- a/packstack/puppet/templates/horizon.pp
+++ b/packstack/puppet/templates/horizon.pp
@@ -52,15 +52,6 @@ File <| path == $::horizon::params::config_file |> {
   mode    => 0640,
 }
 
-if $horizon_ssl {
-  apache::listen { '443': }
-}
-
-if hiera('CONFIG_KEYSTONE_SERVICE_NAME') == 'httpd' {
-  apache::listen { '5000': }
-  apache::listen { '35357': }
-}
-
 # hack for memcached, for now we bind to localhost on ipv6
 # https://bugzilla.redhat.com/show_bug.cgi?id=1210658
 $memcached_bind_host = hiera('CONFIG_IP_VERSION') ? {
diff --git a/packstack/puppet/templates/keystone.pp b/packstack/puppet/templates/keystone.pp
index 157c0cd05..6e4edfc88 100644
--- a/packstack/puppet/templates/keystone.pp
+++ b/packstack/puppet/templates/keystone.pp
@@ -52,10 +52,6 @@ if $keystone_service_name == 'httpd' {
   class { '::keystone::wsgi::apache':
     ssl => $keystone_use_ssl,
   }
-
-  if hiera('CONFIG_HORIZON_SSL') == 'y' {
-    apache::listen { '443': }
-  }
 }
 
 class { '::keystone::roles::admin':
diff --git a/packstack/puppet/templates/nagios_server.pp b/packstack/puppet/templates/nagios_server.pp
index 58905d2a1..811cd7c32 100644
--- a/packstack/puppet/templates/nagios_server.pp
+++ b/packstack/puppet/templates/nagios_server.pp
@@ -94,12 +94,3 @@ firewall { '001 nagios incoming':
   action => 'accept',
 }
 
-# ensure that we won't stop listening on 443 if horizon has ssl enabled
-if hiera('CONFIG_HORIZON_SSL')  == 'y' {
-  apache::listen { '443': }
-}
-
-if hiera('CONFIG_KEYSTONE_SERVICE_NAME') == 'httpd' {
-  apache::listen { '5000': }
-  apache::listen { '35357': }
-}