diff --git a/configure-nonroot.sh b/configure-nonroot.sh
index 39cd157fe..c7b064c6d 100755
--- a/configure-nonroot.sh
+++ b/configure-nonroot.sh
@@ -23,7 +23,7 @@ chown "${IRONIC_USER}":"${IRONIC_GROUP}" /shared
 # that need to have correct ownership as the entire ironic in BMO
 # deployment shares a single fsGroup in manifest's securityContext
 mkdir -p /certs/ca
-chown "${IRONIC_USER}":"${IRONIC_GROUP}" /certs{,/ca}
+chown -R "${IRONIC_USER}":"${IRONIC_GROUP}" /certs{,/ca}
 chmod 2775 /certs{,/ca}
 
 # ironic and httpd related changes