diff --git a/hooks/nova_cc_utils.py b/hooks/nova_cc_utils.py
index e40fcee0..eb5f6411 100644
--- a/hooks/nova_cc_utils.py
+++ b/hooks/nova_cc_utils.py
@@ -903,8 +903,8 @@ def keystone_ca_cert_b64():
     '''Returns the local Keystone-provided CA cert if it exists, or None.'''
     if not os.path.isfile(CA_CERT_PATH):
         return None
-    with open(CA_CERT_PATH) as _in:
-        return base64.b64encode(_in.read())
+    with open(CA_CERT_PATH, 'rb') as _in:
+        return base64.b64encode(_in.read()).decode('utf-8')
 
 
 def ssh_directory_for_unit(unit=None, user=None):
diff --git a/unit_tests/test_nova_cc_utils.py b/unit_tests/test_nova_cc_utils.py
index 9e2b7190..06c92d05 100644
--- a/unit_tests/test_nova_cc_utils.py
+++ b/unit_tests/test_nova_cc_utils.py
@@ -624,6 +624,17 @@ class NovaCCUtilsTests(CharmTestCase):
             self.assertFalse(rm.called)
             _file.write.assert_called_with('|1|= fookey\n')
 
+    @patch('os.path.isfile')
+    def test_keystone_ca_cert_b64(self, isfile):
+        isfile.return_value = True
+        with patch_open() as (_open, _file):
+            _file.readlines = MagicMock()
+            _file.write = MagicMock()
+            _file.read.return_value = b'mycert'
+            self.assertEqual(
+                utils.keystone_ca_cert_b64(),
+                'bXljZXJ0')
+
     @patch('builtins.open')
     @patch('os.mkdir')
     @patch('os.path.isdir')