diff --git a/base/server/python/pki/server/deployment/scriptlets/security_databases.py b/base/server/python/pki/server/deployment/scriptlets/security_databases.py
index 28481c18ea5..cda968dd67e 100644
--- a/base/server/python/pki/server/deployment/scriptlets/security_databases.py
+++ b/base/server/python/pki/server/deployment/scriptlets/security_databases.py
@@ -43,22 +43,10 @@ def spawn(self, deployer):
             logger.info('Skipping NSS database creation')
             return
 
-        instance = self.instance
-        instance.load()
-
-        subsystem = instance.get_subsystem(deployer.subsystem_type.lower())
-
-        if config.str2bool(deployer.mdict['pki_use_pss_rsa_signing_algorithm']):
-            deployer.update_rsa_pss_algorithms(subsystem)
-
         deployer.import_server_pkcs12()
         deployer.import_clone_pkcs12()
         deployer.install_cert_chain()
         deployer.import_ds_ca_cert()
-
-        deployer.init_system_cert_params(subsystem)
-        subsystem.save()
-
         deployer.init_client_nssdb()
 
     def destroy(self, deployer):
diff --git a/base/server/python/pki/server/deployment/scriptlets/subsystem_layout.py b/base/server/python/pki/server/deployment/scriptlets/subsystem_layout.py
index 9da43eb9c70..2dce380a7cb 100644
--- a/base/server/python/pki/server/deployment/scriptlets/subsystem_layout.py
+++ b/base/server/python/pki/server/deployment/scriptlets/subsystem_layout.py
@@ -294,6 +294,12 @@ def spawn(self, deployer):
         subsystem = instance.get_subsystem(subsystem_name)
 
         deployer.init_subsystem(subsystem)
+
+        if config.str2bool(deployer.mdict['pki_use_pss_rsa_signing_algorithm']):
+            deployer.update_rsa_pss_algorithms(subsystem)
+
+        deployer.init_system_cert_params(subsystem)
+
         subsystem.save()
 
     def destroy(self, deployer):