diff --git a/resources/templates/provision/polycom/5.x/{$mac}.cfg b/resources/templates/provision/polycom/5.x/{$mac}.cfg
index dd3f1c6c5d..f09f287ded 100644
--- a/resources/templates/provision/polycom/5.x/{$mac}.cfg
+++ b/resources/templates/provision/polycom/5.x/{$mac}.cfg
@@ -46,13 +46,14 @@
 		{if $row.sip_transport == 'dns srv'}reg.{$row.line_number}.server.2.transport="DNSnaptr"{/if}
 		{if isset($row.register_expires)}reg.{$row.line_number}.server.2.expires="{$row.register_expires}"{else}reg.{$row.line_number}.server.2.expires="{$row.register_expires}"{/if}
 	{/foreach}
-		{if isset($polycom_cert_validation)}sec.TLS.SIP.strictCertCommonNameValidation="{$polycom_cert_validation}"{/if}
-		{if isset($polycom_root_cert)}sec.TLS.customCaCert.5="{$polycom_root_cert}"{/if}
 	/>
 	<SECURITY
 		sec.srtp.enable="{$polycom_srtp_enable}"
 		sec.srtp.offer="{$polycom_srtp_offer}"
 		sec.srtp.require="{$polycom_srtp_require}"
+		{if isset($polycom_cert_validation)}sec.TLS.SIP.strictCertCommonNameValidation="{$polycom_cert_validation}"{/if}
+		{if isset($polycom_root_cert)}sec.TLS.customCaCert.5="{$polycom_root_cert}"{/if}
+		{if isset($polycom_provision_cert_validate)}device.sec.TLS.prov.strictCertCommonNameValidation"{$polycom_provision_cert_validate}"
 	/>
 	<DEVICE_SETTINGS
 		device.set="1"