diff --git a/manifests/candlepin.pp b/manifests/candlepin.pp
index 5284eb86..ad21dd4b 100644
--- a/manifests/candlepin.pp
+++ b/manifests/candlepin.pp
@@ -31,7 +31,8 @@
   include katello::params
 
   class { 'certs::candlepin':
-    hostname => $katello::params::candlepin_host,
+    hostname             => $katello::params::candlepin_host,
+    client_keypair_group => $katello::params::candlepin_client_keypair_group,
   }
 
   class { 'candlepin':
diff --git a/manifests/params.pp b/manifests/params.pp
index 607d66a5..14720726 100644
--- a/manifests/params.pp
+++ b/manifests/params.pp
@@ -32,6 +32,7 @@
   String[1] $candlepin_oauth_secret = $katello::globals::candlepin_oauth_secret,
   Stdlib::Host $candlepin_host = 'localhost',
   Stdlib::HTTPSUrl $candlepin_url = "https://${candlepin_host}:8443/candlepin",
+  String[1] $candlepin_client_keypair_group = 'foreman',
   String[1] $postgresql_evr_package = $katello::globals::postgresql_evr_package,
 ) inherits katello::globals {
 }
diff --git a/spec/setup_acceptance_node.pp b/spec/setup_acceptance_node.pp
index 29c4fa86..4a80c5da 100644
--- a/spec/setup_acceptance_node.pp
+++ b/spec/setup_acceptance_node.pp
@@ -8,6 +8,10 @@
   version => 'nightly',
 }
 
+group { 'foreman':
+  ensure => present,
+}
+
 if $facts['os']['release']['major'] == '8' {
   # https://tickets.puppetlabs.com/browse/PUP-9978
   exec { '/usr/bin/dnf -y module enable pki-core':