diff --git a/ansible/roles/kolla-ansible/templates/globals.yml.j2 b/ansible/roles/kolla-ansible/templates/globals.yml.j2
index 6bc96d479..b7a90ec51 100644
--- a/ansible/roles/kolla-ansible/templates/globals.yml.j2
+++ b/ansible/roles/kolla-ansible/templates/globals.yml.j2
@@ -184,12 +184,8 @@ kolla_enable_tls_internal: {{ kolla_enable_tls_internal | bool }}
 kolla_enable_tls_external: {{ kolla_enable_tls_external | bool }}
 kolla_external_fqdn_cert: "{{ kolla_external_fqdn_cert }}"
 kolla_internal_fqdn_cert: "{{ kolla_internal_fqdn_cert }}"
-{% if kolla_external_fqdn_cacert %}
 kolla_external_fqdn_cacert: "{{ kolla_external_fqdn_cacert }}"
-{% endif %}
-{% if kolla_internal_fqdn_cacert %}
 kolla_internal_fqdn_cacert: "{{ kolla_internal_fqdn_cacert }}"
-{% endif %}
 
 ################
 # Region options
diff --git a/releasenotes/notes/prevent-wrong-oscacert-variable-9ede7f60c1562a77.yaml b/releasenotes/notes/prevent-wrong-oscacert-variable-9ede7f60c1562a77.yaml
new file mode 100644
index 000000000..436d950f4
--- /dev/null
+++ b/releasenotes/notes/prevent-wrong-oscacert-variable-9ede7f60c1562a77.yaml
@@ -0,0 +1,8 @@
+---
+fixes:
+  - |
+     Fixes an issue where ``OS_CACERT`` variable in ``openrc`` files would be
+     set to the path of a non-existent file. New ``openrc`` files can be
+     generated with the ``kayobe control host bootstrap`` command. `See story
+     2007516 <https://storyboard.openstack.org/#!/story/2007516>`_ for more
+     details.