diff --git a/roles/koji_hub/templates/web.conf.j2 b/roles/koji_hub/templates/web.conf.j2
index 4244136b11..c28c0b8f05 100644
--- a/roles/koji_hub/templates/web.conf.j2
+++ b/roles/koji_hub/templates/web.conf.j2
@@ -4,28 +4,26 @@ SiteName = koji
 
 # Key urls
 {% if env == 'staging' %}
-KojiHubURL = http://koji.stg.fedoraproject.org/kojihub
+KojiHubURL = https://koji.stg.fedoraproject.org/kojihub
 KojiFilesURL = https://kojipkgs.stg.fedoraproject.org/
 {% elif inventory_hostname == 's390-koji01.s390.fedoraproject.org' %}
-KojiHubURL = http://s390.koji.fedoraproject.org/kojihub
-KojiFilesURL = http://s390.koji.fedoraproject.org/kojifiles
+KojiHubURL = https://s390.koji.fedoraproject.org/kojihub
+KojiFilesURL = https://s390.koji.fedoraproject.org/kojifiles
 {% elif inventory_hostname == 'arm-koji01.qa.fedoraproject.org' %}
-KojiHubURL = http://arm.koji.fedoraproject.org/kojihub
-KojiFilesURL = http://arm.koji.fedoraproject.org/kojifiles
+KojiHubURL = https://arm.koji.fedoraproject.org/kojihub
+KojiFilesURL = https://arm.koji.fedoraproject.org/kojifiles
 {% elif inventory_hostname == 'ppc-koji01.ppc.fedoraproject.org' %}
-KojiHubURL = http://ppc.koji.fedoraproject.org/kojihub
-KojiFilesURL = http://ppc.koji.fedoraproject.org/kojifiles
+KojiHubURL = https://ppc.koji.fedoraproject.org/kojihub
+KojiFilesURL = https://ppc.koji.fedoraproject.org/kojifiles
 {% else %}
-KojiHubURL = http://koji.fedoraproject.org/kojihub
+KojiHubURL = https://koji.fedoraproject.org/kojihub
 KojiFilesURL = https://kojipkgs.fedoraproject.org/
 {% endif %}
 
 # SSL authentication options
 KrbRDNS = False
 WebKeytab = /etc/koji-hub-http.keytab
-WebPrincipal = HTTP/koji.{% if env == "staging" %}stg.{% endif %}fedoraproject.org
-ClientCA = /etc/pki/tls/certs/upload_cacert.pem
-KojiHubCA = /etc/pki/tls/certs/extras_cacert.pem
+WebPrincipal = HTTP/koji{{env_suffix}}.fedoraproject.org
 
 LoginTimeout = 72