diff --git a/manifests/candlepin.pp b/manifests/candlepin.pp
index 2d6d8ec4..b2f69521 100644
--- a/manifests/candlepin.pp
+++ b/manifests/candlepin.pp
@@ -22,6 +22,7 @@
   $ca_key_password_file     = $certs::ca_key_password_file,
   $user                     = $certs::user,
   $group                    = 'tomcat',
+  $client_keypair_group     = 'tomcat',
 ) inherits certs {
 
   Exec {
@@ -125,11 +126,11 @@
       cert_file   => $client_cert,
       manage_cert => true,
       cert_owner  => $user,
-      cert_group  => $group,
+      cert_group  => $client_keypair_group,
       cert_mode   => '0440',
       manage_key  => true,
       key_owner   => $user,
-      key_group   => $group,
+      key_group   => $client_keypair_group,
       key_mode    => '0440',
     } ~>
     file { $truststore_password_path: