diff --git a/apache/lib/common b/apache/lib/common
index a8429531..3e753fe0 100644
--- a/apache/lib/common
+++ b/apache/lib/common
@@ -147,7 +147,7 @@ _get_ssl_option_value() {
 
 
 __vhost_cfg_normalize_protocol() {
-    local cfg="$1" protocol
+    local cfg="$1" protocol ssl
     ## XXXvlab: can't cache if libcharm is not able to give me some checksums
     ##   indeed, ``_get_ssl_option_value`` depends on relations calculations...
 
@@ -168,14 +168,15 @@ __vhost_cfg_normalize_protocol() {
 
     case "$protocol" in
         auto)
-            if _get_ssl_option_value "$cfg" >/dev/null 2>&1; then
+            ssl=$(_get_ssl_option_value "$cfg" 2>/dev/null)
+            if [ "$ssl" ] ; then
                 protocol="http,https"
             else
                 protocol="http"
             fi
             ;;
         both)
-            protocol="https,http"
+            protocol="http,https"
             ;;
         ssl|https)
             protocol="https"
@@ -187,7 +188,7 @@ __vhost_cfg_normalize_protocol() {
             err "Invalid value '$protocol' for ${WHITE}protocol$NORMAL option (use one of: http, https, both, auto)."
             return 1
     esac
-    echo ",$protocol,"
+    echo -n ",$protocol,"
     #| tee "$cache_file"
 }
 
diff --git a/apache/test/normalize_protocol b/apache/test/normalize_protocol
new file mode 100644
index 00000000..0c2edfbb
--- /dev/null
+++ b/apache/test/normalize_protocol
@@ -0,0 +1,138 @@
+#!/bin/bash
+
+exname=$(basename $0)
+
+prefix_cmd="
+. /etc/shlib
+
+include common
+include parse
+
+. ../lib/common
+
+"
+
+# mock
+relation-get() {
+    local key="$1"
+    echo "$CFG" | shyaml get-value "$key" 2>/dev/null
+}
+export -f relation-get
+
+cfg-get-value() {
+    local key="$1"
+    shyaml get-value "$key" 2>/dev/null
+}
+export -f cfg-get-value
+
+get_service_relations() {
+    printf "%s\0" "${RELATIONS[@]}"
+}
+export -f get_service_relations
+
+export state_tmpdir=$(mktemp -d -t tmp.XXXXXXXXXX)
+trap "rm -rf \"$state_tmpdir\"" EXIT
+
+##
+## Tests
+##
+
+try "
+__vhost_cfg_normalize_protocol '
+protocol: both
+'"
+noerror
+is out ',http,https,'
+
+try "
+__vhost_cfg_normalize_protocol '
+protocol: http
+'"
+noerror
+is out ',http,'
+
+
+try "
+__vhost_cfg_normalize_protocol '
+protocol: https
+'"
+noerror
+is out ',https,'
+
+try "
+__vhost_cfg_normalize_protocol '
+protocol: ssl
+'"
+noerror
+is out ',https,'
+
+
+##
+## auto
+##
+
+
+try "
+__vhost_cfg_normalize_protocol '
+protocol: auto
+'"
+noerror
+is out ',http,'
+
+try "
+__vhost_cfg_normalize_protocol '
+'"
+noerror
+is out ',http,'
+
+
+try "
+__vhost_cfg_normalize_protocol '
+ssl: false
+'"
+noerror
+is out ',http,'
+
+
+try "
+__vhost_cfg_normalize_protocol '
+ssl: null
+'"
+noerror
+is out ',http,'
+
+
+try "
+__vhost_cfg_normalize_protocol '
+ssl: true
+'"
+noerror
+is out ',http,https,'
+
+
+## This case is special, we have values, but we don't know
+## how if there are any plugin that can use it. For this
+## function's responsibility, we are wanting 'ssl'.
+try "
+__vhost_cfg_normalize_protocol '
+ssl: xxx
+'"
+noerror
+is out ',http,https,'
+
+
+try "
+RELATIONS=(cert-provider foo a True)
+__vhost_cfg_normalize_protocol '
+'" "no ssl, but with cert-provider"
+noerror
+is out ',http,https,'
+
+
+try "
+RELATIONS=(cert-provider foo a True)
+__vhost_cfg_normalize_protocol '
+ssl: false
+'" "with explicit ssl disable, but with cert-provider"
+noerror
+is out ',http,'