diff --git a/ansible/roles/certificates/templates/openssl-kolla.cnf.j2 b/ansible/roles/certificates/templates/openssl-kolla.cnf.j2
index c9bbce5321..e580fa613a 100644
--- a/ansible/roles/certificates/templates/openssl-kolla.cnf.j2
+++ b/ansible/roles/certificates/templates/openssl-kolla.cnf.j2
@@ -14,3 +14,9 @@ subjectAltName = @alt_names
 
 [alt_names]
 IP.1 = {{ kolla_external_vip_address }}
+# NOTE(Xing Zhang): Add IPv6 external VIP address to IP.2 when
+# ipv6-control-plane is implemented.
+#IP.2 =
+{% if kolla_external_fqdn != kolla_external_vip_address %}
+DNS.1 = {{ kolla_external_fqdn }}
+{% endif %}