diff --git a/xos/services/vpn/admin.py b/xos/services/vpn/admin.py
index d2de5d1..75164aa 100644
--- a/xos/services/vpn/admin.py
+++ b/xos/services/vpn/admin.py
@@ -152,14 +152,15 @@
                     self.instance.clients_can_see_each_other)
             self.fields['is_persistent'].initial = self.instance.is_persistent
             self.initial['protocol'] = self.instance.protocol
-            self.initial['failover_servers'] = self.instance.failover_servers
+            self.initial['failover_servers'] = VPNTenant.get_tenant_objects.filter(
+                    pk__in=self.instance.failover_server_ids)
             self.fields['failover_servers'].queryset = (
                 VPNTenant.get_tenant_objects().exclude(pk=self.instance.pk))
             self.fields['use_ca_from'].queryset = (
                 VPNTenant.get_tenant_objects().exclude(pk=self.instance.pk))
-            if (self.instance.use_ca_from):
+            if (self.instance.use_ca_from_id):
                 self.fields['use_ca_from'].initial = (
-                    self.instance.use_ca_from[0])
+                    VPNTenant.get_tenant_objects.filter(pk=self.instnace.use_ca_from_id))
 
         if (not self.instance) or (not self.instance.pk):
             self.fields['creator'].initial = get_request().user
@@ -182,9 +183,9 @@
         self.instance.clients_can_see_each_other = self.cleaned_data.get(
             'clients_can_see_each_other')
 
-        self.instance.failover_servers[:] = []
+        self.instance.failover_server_ids = list()
         for tenant in self.cleaned_data['failover_servers']:
-            self.instance.failover_servers.append(tenant)
+            self.instance.failover_server_ids.append(tenant.id)
 
         # Do not aquire a new port number if the protocol hasn't changed
         if ((not self.instance.protocol) or
@@ -194,8 +195,7 @@
                 self.instance.provider_service.get_next_available_port(
                     self.instance.protocol))
 
-        self.instance.use_ca_from[:] = []
-        self.instance.use_ca_from.append(self.cleaned_data.get('use_ca_from'))
+        self.instance.use_ca_from_id = self.cleaned_data.get('use_ca_from').id
         result.save()  # Need to do this so that we know the ID
 
         self.instance.pki_dir = (
@@ -206,13 +206,10 @@
                 self.instance.pki_dir, "init-pki")
             VPNService.execute_easyrsa_command(
                 self.instance.pki_dir, "--req-cn=XOS build-ca nopass")
-        if (self.instance.use_ca_from[0]):
-            shutil.copy2(
-                self.instance.use_ca_from[0].pki_dir + "/ca.crt",
-                self.instance.pki_dir)
-            shutil.copy2(
-                self.instance.use_ca_from[0].pki_dir + "/private/ca.key",
-                self.instance.pki_dir + "/private")
+        if (self.instance.use_ca_from_id):
+            tenant = VPNTenant.get_tenant_objects().filter(pk=self.instance.use_ca_from_id)[0]
+            shutil.copy2(tenant.pki_dir + "/ca.crt", self.instance.pki_dir)
+            shutil.copy2(tenant.pki_dir + "/private/ca.key", self.instance.pki_dir + "/private")
 
         result.ca_crt = self.generate_ca_crt()
 
diff --git a/xos/services/vpn/models.py b/xos/services/vpn/models.py
index 77705d0..6922900 100644
--- a/xos/services/vpn/models.py
+++ b/xos/services/vpn/models.py
@@ -93,8 +93,8 @@
                           'port': None,
                           'script_text': None,
                           'pki_dir': None,
-                          'use_ca_from': list(),
-                          'failover_servers': list(),
+                          'use_ca_from_id': None,
+                          'failover_server_ids': list(),
                           'protocol': None}
 
     def __init__(self, *args, **kwargs):
@@ -122,13 +122,13 @@
         self.set_attribute("protocol", value)
 
     @property
-    def use_ca_from(self):
+    def use_ca_from_id(self):
         return self.get_attribute(
-            "use_ca_from", self.default_attributes["use_ca_from"])
+            "use_ca_from_id", self.default_attributes["use_ca_from_id"])
 
-    @use_ca_from.setter
-    def use_ca_from(self, value):
-        self.set_attribute("use_ca_from", value)
+    @use_ca_from_id.setter
+    def use_ca_from_id(self, value):
+        self.set_attribute("use_ca_from_id", value)
 
     @property
     def pki_dir(self):
@@ -201,13 +201,13 @@
         self.set_attribute("is_persistent", value)
 
     @property
-    def failover_servers(self):
+    def failover_server_ids(self):
         return self.get_attribute(
-            "failover_servers", self.default_attributes["failover_servers"])
+            "failover_server_ids", self.default_attributes["failover_server_ids"])
 
-    @failover_servers.setter
-    def failover_servers(self, value):
-        self.set_attribute("failover_servers", value)
+    @failover_server_ids.setter
+    def failover_server_ids(self, value):
+        self.set_attribute("failover_server_ids", value)
 
     @property
     def clients_can_see_each_other(self):
@@ -296,9 +296,10 @@
                 "verb 3\n" +
                 self.get_remote_line(
                     self.nat_ip, self.port_number, self.protocol))
-        for remote in self.failover_servers:
+        for remote in self.failover_server_ids:
+            tenant = VPNTenant.get_tenant_objects().filter(pk=remote)[0]
             conf += self.get_remote_line(
-                remote.nat_ip, remote.port_number, remote.protocol)
+                tenant.nat_ip, tenant.port_number, tenant.protocol)
 
         if self.is_persistent:
             conf += "persist-tun\n"