diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c
index 5efc8d52d9b823b0221b1d2b4ae78c5fba6831a4..ae520fe3dec02e5af77c8e214a6f74e4c01e2ea2 100644
--- a/src/qemu/qemu_hotplug.c
+++ b/src/qemu/qemu_hotplug.c
@@ -1647,10 +1647,12 @@ qemuDomainGetChardevTLSObjects(virQEMUDriverConfigPtr cfg,
 
 
 static int
-qemuDomainAddChardevTLSObjects(virQEMUDriverPtr driver,
+qemuDomainAddChardevTLSObjects(virConnectPtr conn,
+                               virQEMUDriverPtr driver,
                                virQEMUDriverConfigPtr cfg,
                                virDomainObjPtr vm,
                                virDomainChrSourceDefPtr dev,
+                               char *devAlias,
                                char *charAlias,
                                char **tlsAlias,
                                char **secAlias)
@@ -1664,6 +1666,9 @@ qemuDomainAddChardevTLSObjects(virQEMUDriverPtr driver,
         dev->data.tcp.haveTLS != VIR_TRISTATE_BOOL_YES)
         return 0;
 
+    if (qemuDomainSecretChardevPrepare(conn, cfg, priv, devAlias, dev) < 0)
+        goto cleanup;
+
     if (qemuDomainGetChardevTLSObjects(cfg, priv, dev, charAlias,
                                        &tlsProps, tlsAlias,
                                        &secProps, secAlias) < 0)
@@ -1720,12 +1725,9 @@ int qemuDomainAttachRedirdevDevice(virConnectPtr conn,
     if (VIR_REALLOC_N(def->redirdevs, def->nredirdevs+1) < 0)
         goto cleanup;
 
-    if (qemuDomainSecretChardevPrepare(conn, cfg, priv, redirdev->info.alias,
-                                       redirdev->source) < 0)
-        goto cleanup;
-
-    if (qemuDomainAddChardevTLSObjects(driver, cfg, vm, redirdev->source,
-                                       charAlias, &tlsAlias, &secAlias) < 0)
+    if (qemuDomainAddChardevTLSObjects(conn, driver, cfg, vm, redirdev->source,
+                                       redirdev->info.alias, charAlias,
+                                       &tlsAlias, &secAlias) < 0)
         goto audit;
 
     qemuDomainObjEnterMonitor(driver, vm);
@@ -1981,11 +1983,8 @@ int qemuDomainAttachChrDevice(virConnectPtr conn,
     if (qemuDomainChrPreInsert(vmdef, chr) < 0)
         goto cleanup;
 
-    if (qemuDomainSecretChardevPrepare(conn, cfg, priv, chr->info.alias,
-                                       dev) < 0)
-        goto cleanup;
-
-    if (qemuDomainAddChardevTLSObjects(driver, cfg, vm, dev, charAlias,
+    if (qemuDomainAddChardevTLSObjects(conn, driver, cfg, vm, dev,
+                                       chr->info.alias, charAlias,
                                        &tlsAlias, &secAlias) < 0)
         goto audit;
 
@@ -2123,12 +2122,10 @@ qemuDomainAttachRNGDevice(virConnectPtr conn,
         goto cleanup;
 
     if (rng->backend == VIR_DOMAIN_RNG_BACKEND_EGD) {
-        if (qemuDomainSecretChardevPrepare(conn, cfg, priv, rng->info.alias,
-                                           rng->source.chardev) < 0)
-            goto cleanup;
-
-        if (qemuDomainAddChardevTLSObjects(driver, cfg, vm, rng->source.chardev,
-                                           charAlias, &tlsAlias, &secAlias) < 0)
+        if (qemuDomainAddChardevTLSObjects(conn, driver, cfg, vm,
+                                           rng->source.chardev,
+                                           rng->info.alias, charAlias,
+                                           &tlsAlias, &secAlias) < 0)
             goto audit;
     }