diff --git a/src/main/java/com/rjrudin/marklogic/appdeployer/command/security/CreateCertificateTemplatesCommand.java b/src/main/java/com/rjrudin/marklogic/appdeployer/command/security/CreateCertificateTemplatesCommand.java
index 2d4a6d34..5808517b 100644
--- a/src/main/java/com/rjrudin/marklogic/appdeployer/command/security/CreateCertificateTemplatesCommand.java
+++ b/src/main/java/com/rjrudin/marklogic/appdeployer/command/security/CreateCertificateTemplatesCommand.java
@@ -1,11 +1,14 @@
 package com.rjrudin.marklogic.appdeployer.command.security;
 
 import java.io.File;
+import java.net.URI;
+import java.util.Map;
 
 import com.rjrudin.marklogic.appdeployer.command.AbstractResourceCommand;
 import com.rjrudin.marklogic.appdeployer.command.CommandContext;
 import com.rjrudin.marklogic.appdeployer.command.SortOrderConstants;
 import com.rjrudin.marklogic.mgmt.ResourceManager;
+import com.rjrudin.marklogic.mgmt.SaveReceipt;
 import com.rjrudin.marklogic.mgmt.security.CertificateTemplateManager;
 
 public class CreateCertificateTemplatesCommand extends AbstractResourceCommand {
@@ -24,4 +27,32 @@ protected ResourceManager getResourceManager(CommandContext context) {
         return new CertificateTemplateManager(context.getManageClient());
     }
 
+    @Override
+    protected void afterResourceSaved(ResourceManager mgr, CommandContext context, File resourceFile,
+            SaveReceipt receipt) {
+        URI location = receipt.getResponse().getHeaders().getLocation();
+        Map<String, String> customTokens = context.getAppConfig().getCustomTokens();
+        if (location != null) {
+            // Create
+            String[] tokens = location.getPath().split("/");
+            String id = tokens[tokens.length - 1];
+            String key = "certificate-template-" + receipt.getResourceId();
+            if (logger.isInfoEnabled()) {
+                logger.info(format("Storing token with key '%s' and value '%s'", key, id));
+            }
+            customTokens.put(key, id);
+        } else {
+            // Update
+            String path = receipt.getPath();
+            String[] tokens = path.split("/");
+            // Path is expected to be /manage/v2/certificate-templates/id/properties
+            String id = tokens[tokens.length - 2];
+            String key = "certificate-template-" + receipt.getResourceId();
+            if (logger.isInfoEnabled()) {
+                logger.info(format("Storing token with key '%s' and value '%s'", key, id));
+            }
+            customTokens.put(key, id);
+        }
+    }
+
 }
diff --git a/src/test/java/com/rjrudin/marklogic/appdeployer/command/AbstractManageResourceTest.java b/src/test/java/com/rjrudin/marklogic/appdeployer/command/AbstractManageResourceTest.java
index c5fae045..fc10363e 100644
--- a/src/test/java/com/rjrudin/marklogic/appdeployer/command/AbstractManageResourceTest.java
+++ b/src/test/java/com/rjrudin/marklogic/appdeployer/command/AbstractManageResourceTest.java
@@ -36,6 +36,14 @@ public abstract class AbstractManageResourceTest extends AbstractAppDeployerTest
     protected void afterResourcesCreated() {
     }
 
+    /**
+     * A subclass can override this to perform additional assertions after the second deploy call has been made, which
+     * most often will result in the resource being updated.
+     */
+    protected void afterResourcesCreatedAgain() {
+
+    }
+
     /**
      * Performs a generic test of creating a resource, then creating it again (to ensure that doesn't cause any failures
      * - this should typically result in an update instead of a create), and then deleting it.
@@ -56,6 +64,8 @@ public void createThenDelete() {
 
             // Make sure we don't get an error from trying to create the resources again
             appDeployer.deploy(appConfig);
+
+            afterResourcesCreatedAgain();
         } finally {
             undeployAndVerifyResourcesWereDeleted(mgr);
         }
diff --git a/src/test/java/com/rjrudin/marklogic/appdeployer/command/security/ManageCertificateTemplatesTest.java b/src/test/java/com/rjrudin/marklogic/appdeployer/command/security/ManageCertificateTemplatesTest.java
index c62b4fb9..10cb750e 100644
--- a/src/test/java/com/rjrudin/marklogic/appdeployer/command/security/ManageCertificateTemplatesTest.java
+++ b/src/test/java/com/rjrudin/marklogic/appdeployer/command/security/ManageCertificateTemplatesTest.java
@@ -1,5 +1,7 @@
 package com.rjrudin.marklogic.appdeployer.command.security;
 
+import java.util.Map;
+
 import com.rjrudin.marklogic.appdeployer.command.AbstractManageResourceTest;
 import com.rjrudin.marklogic.appdeployer.command.Command;
 import com.rjrudin.marklogic.mgmt.ResourceManager;
@@ -7,7 +9,7 @@
 
 public class ManageCertificateTemplatesTest extends AbstractManageResourceTest {
 
-    //@Test
+    // @Test
     public void rob() {
         manageClient.putJson("/manage/v2/servers/sample-project/properties?group-id=Default",
                 "{\"ssl-certificate-template\":\"10426856940027527644\"}");
@@ -28,4 +30,23 @@ protected String[] getResourceNames() {
         return new String[] { "sample-app-template" };
     }
 
+    @Override
+    protected void afterResourcesCreated() {
+        Map<String, String> customTokens = appConfig.getCustomTokens();
+        String key = "certificate-template-sample-app-template";
+        assertNotNull(
+                "The cert template ID should have been stored in the tokens map so that it can be referenced in an HTTP server file",
+                customTokens.get(key));
+
+        // Clear out the key so we can verify it's set again during the second deploy
+        customTokens.remove(key);
+    }
+
+    @Override
+    protected void afterResourcesCreatedAgain() {
+        Map<String, String> customTokens = appConfig.getCustomTokens();
+        String key = "certificate-template-sample-app-template";
+        assertNotNull("Verifying that the cert template ID is stored on an update as well", customTokens.get(key));
+    }
+
 }