diff --git a/roles/koji_hub/tasks/main.yaml b/roles/koji_hub/tasks/main.yaml
index 99e5282..6ec6ab7 100644
--- a/roles/koji_hub/tasks/main.yaml
+++ b/roles/koji_hub/tasks/main.yaml
@@ -115,8 +115,8 @@
   ansible.builtin.copy:
     src: "{{ koji_pki_dir }}/{{ item.src }}"
     dest: "{{ item.dest }}"
-    owner: root
-    group: root
+    owner: "{{ item.owner | default('root') }}"
+    group: "{{ item.group | default('root') }}"
     mode: "{{ item.mode }}"
   loop:
     - { src: "{{ koji_ca_name }}_cert.crt", dest: "{{ koji_remote_ca_trust_path }}", mode: "0644" }
diff --git a/roles/koji_hub/templates/hub.conf.j2 b/roles/koji_hub/templates/hub.conf.j2
index c48cbc6..832f1aa 100644
--- a/roles/koji_hub/templates/hub.conf.j2
+++ b/roles/koji_hub/templates/hub.conf.j2
@@ -25,7 +25,7 @@ AllowedSCMs = {{ koji_allowed_scms | default('git.mx-os.mx:/RPMs/*.git:*:use_com
 DNUsernameComponent = CN
 # ProxyDNs is used to allow a specific user (usually the web interface) to act as others
 # This should match the DN of the 'kojiweb' certificate
-ProxyDNs = /C={{ koji_cert_country }}/ST={{ koji_cert_state }}/L={{ koji_cert_locality }}/O={{ koji_cert_organization }}/CN={{ koji_hub_fqdn }}
+ProxyDNs = /C={{ koji_cert_country }}/ST={{ koji_cert_state }}/L={{ koji_cert_locality }}/O={{ koji_cert_organization }}/CN={{ koji_hub_fqdn }} | CN={{ koji_hub_fqdn }},O={{ koji_cert_organization }},L={{ koji_cert_locality }},ST={{ koji_cert_state }},C={{ koji_cert_country }}
 
 ##  Other options  ##
 LoginCreatesUser = On
diff --git a/roles/koji_hub/templates/web.conf.j2 b/roles/koji_hub/templates/web.conf.j2
index 1f889e7..23a9617 100644
--- a/roles/koji_hub/templates/web.conf.j2
+++ b/roles/koji_hub/templates/web.conf.j2
@@ -8,5 +8,5 @@ WebCert = /etc/pki/koji/kojiweb.pem
 LoginTimeout = 72
 Secret = {{ web_secret }}
 LibPath = /usr/share/koji-web/lib
-serverca = {{ koji_remote_ca_trust_path }}
+KojiHubCA = {{ koji_remote_ca_trust_path }}
 LiteralFooter = True