diff --git a/manifests/iop_advisor_engine.pp b/manifests/iop_advisor_engine.pp
index f72bee4c..8e46bb3f 100644
--- a/manifests/iop_advisor_engine.pp
+++ b/manifests/iop_advisor_engine.pp
@@ -36,35 +36,46 @@
     build_dir     => $certs::ssl_build_dir,
   }
 
-  if $deploy {
-    $cert_directory = '/etc/iop-advisor-engine'
+  $cert_directory = '/etc/iop-advisor-engine'
 
-    $server_cert = "${cert_directory}/server.cert"
-    $server_key = "${cert_directory}/server.key"
-    $server_ca_cert = $certs::katello_server_ca_cert
+  $server_cert = "${cert_directory}/server.cert"
+  $server_key = "${cert_directory}/server.key"
+  $server_ca_cert = $certs::katello_server_ca_cert
 
-    $client_cert = $certs::foreman_proxy::foreman_ssl_cert
-    $client_key = $certs::foreman_proxy::foreman_ssl_key
-    $client_ca_cert = $certs::foreman_proxy::foreman_ssl_ca_cert
+  $client_cert = $certs::foreman_proxy::foreman_ssl_cert
+  $client_key = $certs::foreman_proxy::foreman_ssl_key
+  $client_ca_cert = $certs::foreman_proxy::foreman_ssl_ca_cert
 
-    file { $cert_directory:
-      ensure => directory,
-      mode   => '0755',
-      owner  => $owner,
-      group  => $group,
-    }
+  $directory_ensure = $deploy ? {
+    true  => 'directory',
+    false => 'absent',
+  }
+
+  $keypair_ensure = $deploy ? {
+    true  => 'present',
+    false => 'absent',
+  }
+
+  file { $cert_directory:
+    ensure => $directory_ensure,
+    mode   => '0755',
+    owner  => $owner,
+    group  => $group,
+    force  => true,
+  }
 
-    certs::keypair { $server_cert_name:
-      source_dir => "${certs::ssl_build_dir}/${hostname}",
-      key_file   => $server_key,
-      key_owner  => $owner,
-      key_group  => $group,
-      key_mode   => $private_key_mode,
-      cert_file  => $server_cert,
-      cert_owner => $owner,
-      cert_group => $group,
-      cert_mode  => $public_key_mode,
-      require    => Cert[$server_cert_name],
-    }
+  certs::keypair { $server_cert_name:
+    source_dir  => "${certs::ssl_build_dir}/${hostname}",
+    key_ensure  => $keypair_ensure,
+    key_file    => $server_key,
+    key_owner   => $owner,
+    key_group   => $group,
+    key_mode    => $private_key_mode,
+    cert_ensure => $keypair_ensure,
+    cert_file   => $server_cert,
+    cert_owner  => $owner,
+    cert_group  => $group,
+    cert_mode   => $public_key_mode,
+    require     => Cert[$server_cert_name],
   }
 }
diff --git a/spec/acceptance/iop_advisor_engine_spec.rb b/spec/acceptance/iop_advisor_engine_spec.rb
index 5d15fc3c..5d9f5fae 100644
--- a/spec/acceptance/iop_advisor_engine_spec.rb
+++ b/spec/acceptance/iop_advisor_engine_spec.rb
@@ -108,4 +108,29 @@ class { 'certs::iop_advisor_engine':
       it { should_not exist }
     end
   end
+
+  context 'with generate false and deploy false' do
+    it_behaves_like 'an idempotent resource' do
+      let(:manifest) do
+        <<-PUPPET
+          class { 'certs::iop_advisor_engine':
+            generate => false,
+            deploy => false
+          }
+        PUPPET
+      end
+    end
+
+    describe file('/etc/iop-advisor-engine') do
+      it { should_not exist }
+    end
+
+    describe file('/etc/iop-advisor-engine/server.cert') do
+      it { should_not exist }
+    end
+
+    describe file('/etc/iop-advisor-engine/server.key') do
+      it { should_not exist }
+    end
+  end
 end