diff --git a/ziti/cmd/config_templates/controller.yml b/ziti/cmd/config_templates/controller.yml
index c2ed00994..cd421a677 100644
--- a/ziti/cmd/config_templates/controller.yml
+++ b/ziti/cmd/config_templates/controller.yml
@@ -14,9 +14,9 @@ identity:
   server_cert: "{{ .Controller.Identity.ServerCert }}"
   key:         "{{ .Controller.Identity.Key }}"
   ca:          "{{ .Controller.Identity.Ca }}"
-  {{ .Controller.Web.Identity.AltCertsEnabled }}alt_server_certs:
-  {{ .Controller.Web.Identity.AltCertsEnabled }}  - server_cert:  "{{ .Controller.Web.Identity.AltServerCert }}"
-  {{ .Controller.Web.Identity.AltCertsEnabled }}    server_key:   "{{ .Controller.Web.Identity.AltServerKey }}"
+  {{ if not .Controller.Web.Identity.AltCertsEnabled }}#{{ end }}alt_server_certs:
+  {{ if not .Controller.Web.Identity.AltCertsEnabled }}#{{ end }}  - server_cert:  "{{ .Controller.Web.Identity.AltServerCert }}"
+  {{ if not .Controller.Web.Identity.AltCertsEnabled }}#{{ end }}    server_key:   "{{ .Controller.Web.Identity.AltServerKey }}"
 
 # Network Configuration
 #
@@ -168,9 +168,9 @@ web:
       key:         "{{ .Controller.Web.Identity.Key }}"
       server_cert: "{{ .Controller.Web.Identity.ServerCert }}"
       cert:        "{{ .Controller.Web.Identity.Cert }}"
-      {{ .Controller.Web.Identity.AltCertsEnabled }}alt_server_certs:
-      {{ .Controller.Web.Identity.AltCertsEnabled }}- server_cert: "{{ .Controller.Web.Identity.AltServerCert }}"
-      {{ .Controller.Web.Identity.AltCertsEnabled }}  server_key:  "{{ .Controller.Web.Identity.AltServerKey }}"
+      {{ if not .Controller.Web.Identity.AltCertsEnabled }}#{{ end }}alt_server_certs:
+      {{ if not .Controller.Web.Identity.AltCertsEnabled }}#{{ end }}- server_cert: "{{ .Controller.Web.Identity.AltServerCert }}"
+      {{ if not .Controller.Web.Identity.AltCertsEnabled }}#{{ end }}  server_key:  "{{ .Controller.Web.Identity.AltServerKey }}"
       
     # options - optional
     # Allows the specification of webListener level options - mainly dealing with HTTP/TLS settings. These options are
diff --git a/ziti/cmd/config_templates/router.yml b/ziti/cmd/config_templates/router.yml
index f64ca8a8a..c383e1c4f 100644
--- a/ziti/cmd/config_templates/router.yml
+++ b/ziti/cmd/config_templates/router.yml
@@ -12,9 +12,9 @@ identity:
   server_cert:      "{{ .Router.IdentityServerCert }}"
   key:              "{{ .Router.IdentityKey }}"
   ca:               "{{ .Router.IdentityCA }}"
-{{ if not .Router.AltCertsEnabled }}#{{ end }}alt_server_certs:
-{{ if not .Router.AltCertsEnabled }}#{{ end }}  - server_cert:  "{{ .Router.AltServerCert }}"
-{{ if not .Router.AltCertsEnabled }}#{{ end }}    server_key:   "{{ .Router.AltServerKey }}"
+  {{ if not .Router.AltCertsEnabled }}#{{ end }}alt_server_certs:
+  {{ if not .Router.AltCertsEnabled }}#{{ end }}  - server_cert:  "{{ .Router.AltServerCert }}"
+  {{ if not .Router.AltCertsEnabled }}#{{ end }}    server_key:   "{{ .Router.AltServerKey }}"
 
 ctrl:
   endpoint:             tls:{{ .Controller.Ctrl.AdvertisedAddress }}:{{ .Controller.Ctrl.AdvertisedPort }}
@@ -87,9 +87,9 @@ edge:
 {{ if not .Router.IsWss }}#{{ end }}    enableCompression: {{ .Router.Wss.EnableCompression }}
 {{ if not .Router.IsWss }}#{{ end }}    server_cert: {{ .Router.IdentityServerCert }}
 {{ if not .Router.IsWss }}#{{ end }}    key: {{ .Router.IdentityKey }}
-{{ .Router.AltCertsEnabled }}alt_server_certs:
-{{ .Router.AltCertsEnabled }}  - server_cert:  "{{ .Router.AltServerCert }}"
-{{ .Router.AltCertsEnabled }}    server_key:   "{{ .Router.AltServerKey }}"
+{{ if not .Router.AltCertsEnabled }}#{{ end }}alt_server_certs:
+{{ if not .Router.AltCertsEnabled }}#{{ end }}  - server_cert:  "{{ .Router.AltServerCert }}"
+{{ if not .Router.AltCertsEnabled }}#{{ end }}    server_key:   "{{ .Router.AltServerKey }}"
 forwarder:
   latencyProbeInterval: {{ .Router.Forwarder.LatencyProbeInterval.Seconds }}
   xgressDialQueueLength: {{ .Router.Forwarder.XgressDialQueueLength }}