diff --git a/pkg/apis/ceph.rook.io/v1/object.go b/pkg/apis/ceph.rook.io/v1/object.go
index de0bb1a1e..9af467a76 100644
--- a/pkg/apis/ceph.rook.io/v1/object.go
+++ b/pkg/apis/ceph.rook.io/v1/object.go
@@ -26,7 +26,7 @@ import (
 // will be registered for the validating webhook.
 var _ webhook.Validator = &CephObjectStore{}
 
-const serviceServingCertKey = "service.beta.openshift.io/serving-cert-secret-name"
+const ServiceServingCertKey = "service.beta.openshift.io/serving-cert-secret-name"
 
 func (s *ObjectStoreSpec) IsMultisite() bool {
 	return s.Zone.Name != ""
@@ -85,7 +85,7 @@ func (o *CephObjectStore) ValidateDelete() error {
 
 func (s *ObjectStoreSpec) GetServiceServingCert() string {
 	if s.Gateway.Service != nil {
-		return s.Gateway.Service.Annotations[serviceServingCertKey]
+		return s.Gateway.Service.Annotations[ServiceServingCertKey]
 	}
 	return ""
 }
diff --git a/pkg/apis/ceph.rook.io/v1/object_test.go b/pkg/apis/ceph.rook.io/v1/object_test.go
index 28e16e6bf..b442bd7c5 100644
--- a/pkg/apis/ceph.rook.io/v1/object_test.go
+++ b/pkg/apis/ceph.rook.io/v1/object_test.go
@@ -19,6 +19,7 @@ package v1
 import (
 	"testing"
 
+	rookv1 "github.com/rook/rook/pkg/apis/rook.io/v1"
 	"github.com/stretchr/testify/assert"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
@@ -59,3 +60,40 @@ func TestValidateObjectStoreSpec(t *testing.T) {
 	err = ValidateObjectSpec(o)
 	assert.Error(t, err)
 }
+func TestIsTLSEnabled(t *testing.T) {
+	objStore := &CephObjectStore{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "my-store",
+			Namespace: "rook-ceph",
+		},
+		Spec: ObjectStoreSpec{
+			Gateway: GatewaySpec{
+				Port:       1,
+				SecurePort: 0,
+			},
+		},
+	}
+	IsTLS := objStore.Spec.IsTLSEnabled()
+	assert.False(t, IsTLS)
+
+	// only securePort is set without certs
+	objStore.Spec.Gateway.SecurePort = 443
+	IsTLS = objStore.Spec.IsTLSEnabled()
+	assert.False(t, IsTLS)
+
+	// when SSLCertificateRef is set with securePort
+	objStore.Spec.Gateway.SSLCertificateRef = "my-tls-cert"
+	IsTLS = objStore.Spec.IsTLSEnabled()
+	assert.True(t, IsTLS)
+
+	// when service serving cert is used
+	objStore.Spec.Gateway.SSLCertificateRef = ""
+	objStore.Spec.Gateway.Service = &(RGWServiceSpec{Annotations: rookv1.Annotations{ServiceServingCertKey: "rgw-cert"}})
+	IsTLS = objStore.Spec.IsTLSEnabled()
+	assert.True(t, IsTLS)
+
+	// when cert are set but securePort unset
+	objStore.Spec.Gateway.SecurePort = 0
+	IsTLS = objStore.Spec.IsTLSEnabled()
+	assert.False(t, IsTLS)
+}
diff --git a/pkg/operator/ceph/object/spec_test.go b/pkg/operator/ceph/object/spec_test.go
index fd46ea609..2915a0ce7 100644
--- a/pkg/operator/ceph/object/spec_test.go
+++ b/pkg/operator/ceph/object/spec_test.go
@@ -22,6 +22,7 @@ import (
 
 	"github.com/pkg/errors"
 	cephv1 "github.com/rook/rook/pkg/apis/ceph.rook.io/v1"
+	rookv1 "github.com/rook/rook/pkg/apis/rook.io/v1"
 	"github.com/rook/rook/pkg/clusterd"
 	"github.com/rook/rook/pkg/daemon/ceph/client"
 	clienttest "github.com/rook/rook/pkg/daemon/ceph/client/test"
@@ -102,7 +103,6 @@ func TestSSLPodSpec(t *testing.T) {
 	info := clienttest.CreateTestClusterInfo(1)
 	info.CephVersion = cephver.Nautilus
 	data := cephconfig.NewStatelessDaemonDataPathMap(cephconfig.RgwType, "default", "rook-ceph", "/var/lib/rook/")
-	store.Spec.Gateway.SSLCertificateRef = "mycert"
 	store.Spec.Gateway.SecurePort = 443
 
 	c := &clusterConfig{
@@ -122,14 +122,33 @@ func TestSSLPodSpec(t *testing.T) {
 	rgwConfig := &rgwConfig{
 		ResourceName: resourceName,
 	}
+	_, err := c.makeRGWPodSpec(rgwConfig)
+	// No TLS certs specified, will return error
+	assert.Error(t, err)
+
+	// Using SSLCertificateRef
+	c.store.Spec.Gateway.SSLCertificateRef = "mycert"
+	secretVolSrc, _ := generateVolumeSourceWithTLSSecret(c.store.Spec)
+	assert.Equal(t, secretVolSrc.SecretName, "mycert")
 	s, err := c.makeRGWPodSpec(rgwConfig)
 	assert.NoError(t, err)
-
 	podTemplate := test.NewPodTemplateSpecTester(t, &s)
 	podTemplate.RunFullSuite(cephconfig.RgwType, "default", "rook-ceph-rgw", "mycluster", "ceph/ceph:myversion",
 		"200", "100", "1337", "500", /* resources */
 		"my-priority-class")
 
+	// Using service serving cert
+	c.store.Spec.Gateway.SSLCertificateRef = ""
+	c.store.Spec.Gateway.Service = &(cephv1.RGWServiceSpec{Annotations: rookv1.Annotations{cephv1.ServiceServingCertKey: "rgw-cert"}})
+	secretVolSrc, _ = generateVolumeSourceWithTLSSecret(c.store.Spec)
+	assert.Equal(t, secretVolSrc.SecretName, "rgw-cert")
+	s, err = c.makeRGWPodSpec(rgwConfig)
+	assert.NoError(t, err)
+	podTemplate = test.NewPodTemplateSpecTester(t, &s)
+	podTemplate.RunFullSuite(cephconfig.RgwType, "default", "rook-ceph-rgw", "mycluster", "ceph/ceph:myversion",
+		"200", "100", "1337", "500", /* resources */
+		"my-priority-class")
+
 	assert.True(t, s.Spec.HostNetwork)
 	assert.Equal(t, v1.DNSClusterFirstWithHostNet, s.Spec.DNSPolicy)