diff --git a/manifests/profile/base/database/mysql.pp b/manifests/profile/base/database/mysql.pp
index 8eb6079b8..ef5f05db3 100644
--- a/manifests/profile/base/database/mysql.pp
+++ b/manifests/profile/base/database/mysql.pp
@@ -95,6 +95,9 @@ class tripleo::profile::base::database::mysql (
   if $enable_internal_tls {
     $tls_certfile = $certificate_specs['service_certificate']
     $tls_keyfile = $certificate_specs['service_key']
+
+    # Force users/grants created to use TLS connections
+    Openstacklib::Db::Mysql <||> { tls_options => ['SSL'] }
   } else {
     $tls_certfile = undef
     $tls_keyfile = undef