diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c
index 30d35caebf..3233dea7c9 100644
--- a/src/qemu/qemu_hotplug.c
+++ b/src/qemu/qemu_hotplug.c
@@ -1528,6 +1528,85 @@ qemuDomainAttachHostPCIDevice(virQEMUDriverPtr driver,
 }
 
 
+void
+qemuDomainDelTLSObjects(virQEMUDriverPtr driver,
+                        virDomainObjPtr vm,
+                        const char *secAlias,
+                        const char *tlsAlias)
+{
+    qemuDomainObjPrivatePtr priv = vm->privateData;
+    virErrorPtr orig_err;
+
+    if (!tlsAlias && !secAlias)
+        return;
+
+    orig_err = virSaveLastError();
+
+    qemuDomainObjEnterMonitor(driver, vm);
+
+    if (tlsAlias)
+        ignore_value(qemuMonitorDelObject(priv->mon, tlsAlias));
+
+    if (secAlias)
+        ignore_value(qemuMonitorDelObject(priv->mon, secAlias));
+
+    ignore_value(qemuDomainObjExitMonitor(driver, vm));
+
+    if (orig_err) {
+        virSetError(orig_err);
+        virFreeError(orig_err);
+    }
+}
+
+
+int
+qemuDomainAddTLSObjects(virQEMUDriverPtr driver,
+                        virDomainObjPtr vm,
+                        const char *secAlias,
+                        virJSONValuePtr *secProps,
+                        const char *tlsAlias,
+                        virJSONValuePtr *tlsProps)
+{
+    qemuDomainObjPrivatePtr priv = vm->privateData;
+    int rc;
+    virErrorPtr orig_err;
+
+    if (!tlsAlias && !secAlias)
+        return 0;
+
+    qemuDomainObjEnterMonitor(driver, vm);
+
+    if (secAlias) {
+        rc = qemuMonitorAddObject(priv->mon, "secret",
+                                  secAlias, *secProps);
+        *secProps = NULL; /* qemuMonitorAddObject consumes */
+        if (rc < 0)
+            goto error;
+    }
+
+    if (tlsAlias) {
+        rc = qemuMonitorAddObject(priv->mon, "tls-creds-x509",
+                                  tlsAlias, *tlsProps);
+        *tlsProps = NULL; /* qemuMonitorAddObject consumes */
+        if (rc < 0)
+            goto error;
+    }
+
+    return qemuDomainObjExitMonitor(driver, vm);
+
+ error:
+    orig_err = virSaveLastError();
+    ignore_value(qemuDomainObjExitMonitor(driver, vm));
+    if (orig_err) {
+        virSetError(orig_err);
+        virFreeError(orig_err);
+    }
+    qemuDomainDelTLSObjects(driver, vm, secAlias, tlsAlias);
+
+    return -1;
+}
+
+
 static int
 qemuDomainGetChardevTLSObjects(virQEMUDriverConfigPtr cfg,
                                qemuDomainObjPrivatePtr priv,
@@ -1584,8 +1663,6 @@ int qemuDomainAttachRedirdevDevice(virConnectPtr conn,
     char *charAlias = NULL;
     char *devstr = NULL;
     bool chardevAdded = false;
-    bool tlsobjAdded = false;
-    bool secobjAdded = false;
     virJSONValuePtr tlsProps = NULL;
     virJSONValuePtr secProps = NULL;
     char *tlsAlias = NULL;
@@ -1621,26 +1698,12 @@ int qemuDomainAttachRedirdevDevice(virConnectPtr conn,
                                        &secProps, &secAlias) < 0)
         goto cleanup;
 
+    if (qemuDomainAddTLSObjects(driver, vm, secAlias, &secProps,
+                                tlsAlias, &tlsProps) < 0)
+        goto audit;
+
     qemuDomainObjEnterMonitor(driver, vm);
 
-    if (secAlias) {
-        rc = qemuMonitorAddObject(priv->mon, "secret",
-                                  secAlias, secProps);
-        secProps = NULL;
-        if (rc < 0)
-            goto exit_monitor;
-        secobjAdded = true;
-    }
-
-    if (tlsAlias) {
-        rc = qemuMonitorAddObject(priv->mon, "tls-creds-x509",
-                                  tlsAlias, tlsProps);
-        tlsProps = NULL; /* qemuMonitorAddObject consumes */
-        if (rc < 0)
-            goto exit_monitor;
-        tlsobjAdded = true;
-    }
-
     if (qemuMonitorAttachCharDev(priv->mon,
                                  charAlias,
                                  redirdev->source) < 0)
@@ -1674,15 +1737,12 @@ int qemuDomainAttachRedirdevDevice(virConnectPtr conn,
     /* detach associated chardev on error */
     if (chardevAdded)
         ignore_value(qemuMonitorDetachCharDev(priv->mon, charAlias));
-    if (tlsobjAdded)
-        ignore_value(qemuMonitorDelObject(priv->mon, tlsAlias));
-    if (secobjAdded)
-        ignore_value(qemuMonitorDelObject(priv->mon, secAlias));
     ignore_value(qemuDomainObjExitMonitor(driver, vm));
     if (orig_err) {
         virSetError(orig_err);
         virFreeError(orig_err);
     }
+    qemuDomainDelTLSObjects(driver, vm, secAlias, tlsAlias);
     goto audit;
 }
 
@@ -1860,10 +1920,8 @@ int qemuDomainAttachChrDevice(virConnectPtr conn,
     virDomainChrSourceDefPtr dev = chr->source;
     char *charAlias = NULL;
     bool chardevAttached = false;
-    bool tlsobjAdded = false;
     bool teardowncgroup = false;
     bool teardowndevice = false;
-    bool secobjAdded = false;
     virJSONValuePtr tlsProps = NULL;
     char *tlsAlias = NULL;
     virJSONValuePtr secProps = NULL;
@@ -1910,24 +1968,11 @@ int qemuDomainAttachChrDevice(virConnectPtr conn,
                                        &secProps, &secAlias) < 0)
         goto cleanup;
 
-    qemuDomainObjEnterMonitor(driver, vm);
-    if (secAlias) {
-        rc = qemuMonitorAddObject(priv->mon, "secret",
-                                  secAlias, secProps);
-        secProps = NULL;
-        if (rc < 0)
-            goto exit_monitor;
-        secobjAdded = true;
-    }
+    if (qemuDomainAddTLSObjects(driver, vm, secAlias, &secProps,
+                                tlsAlias, &tlsProps) < 0)
+        goto audit;
 
-    if (tlsAlias) {
-        rc = qemuMonitorAddObject(priv->mon, "tls-creds-x509",
-                                  tlsAlias, tlsProps);
-        tlsProps = NULL; /* qemuMonitorAddObject consumes */
-        if (rc < 0)
-            goto exit_monitor;
-        tlsobjAdded = true;
-    }
+    qemuDomainObjEnterMonitor(driver, vm);
 
     if (qemuMonitorAttachCharDev(priv->mon, charAlias, chr->source) < 0)
         goto exit_monitor;
@@ -1968,16 +2013,13 @@ int qemuDomainAttachChrDevice(virConnectPtr conn,
     /* detach associated chardev on error */
     if (chardevAttached)
         qemuMonitorDetachCharDev(priv->mon, charAlias);
-    if (tlsobjAdded)
-        ignore_value(qemuMonitorDelObject(priv->mon, tlsAlias));
-    if (secobjAdded)
-        ignore_value(qemuMonitorDelObject(priv->mon, secAlias));
     ignore_value(qemuDomainObjExitMonitor(driver, vm));
     if (orig_err) {
         virSetError(orig_err);
         virFreeError(orig_err);
     }
 
+    qemuDomainDelTLSObjects(driver, vm, secAlias, tlsAlias);
     goto audit;
 }
 
@@ -2002,8 +2044,6 @@ qemuDomainAttachRNGDevice(virConnectPtr conn,
     bool teardowndevice = false;
     bool chardevAdded = false;
     bool objAdded = false;
-    bool tlsobjAdded = false;
-    bool secobjAdded = false;
     virJSONValuePtr props = NULL;
     virJSONValuePtr tlsProps = NULL;
     virJSONValuePtr secProps = NULL;
@@ -2078,28 +2118,14 @@ qemuDomainAttachRNGDevice(virConnectPtr conn,
                                            charAlias, &tlsProps, &tlsAlias,
                                            &secProps, &secAlias) < 0)
             goto cleanup;
+
+        if (qemuDomainAddTLSObjects(driver, vm, secAlias, &secProps,
+                                    tlsAlias, &tlsProps) < 0)
+            goto audit;
     }
 
     qemuDomainObjEnterMonitor(driver, vm);
 
-    if (secAlias) {
-        rv = qemuMonitorAddObject(priv->mon, "secret",
-                                  secAlias, secProps);
-        secProps = NULL;
-        if (rv < 0)
-            goto exit_monitor;
-        secobjAdded = true;
-    }
-
-    if (tlsAlias) {
-        rv = qemuMonitorAddObject(priv->mon, "tls-creds-x509",
-                                  tlsAlias, tlsProps);
-        tlsProps = NULL; /* qemuMonitorAddObject consumes */
-        if (rv < 0)
-            goto exit_monitor;
-        tlsobjAdded = true;
-    }
-
     if (rng->backend == VIR_DOMAIN_RNG_BACKEND_EGD &&
         qemuMonitorAttachCharDev(priv->mon, charAlias,
                                  rng->source.chardev) < 0)
@@ -2154,10 +2180,6 @@ qemuDomainAttachRNGDevice(virConnectPtr conn,
         ignore_value(qemuMonitorDelObject(priv->mon, objAlias));
     if (rng->backend == VIR_DOMAIN_RNG_BACKEND_EGD && chardevAdded)
         ignore_value(qemuMonitorDetachCharDev(priv->mon, charAlias));
-    if (tlsobjAdded)
-        ignore_value(qemuMonitorDelObject(priv->mon, tlsAlias));
-    if (secobjAdded)
-        ignore_value(qemuMonitorDelObject(priv->mon, secAlias));
     if (qemuDomainObjExitMonitor(driver, vm) < 0)
         releaseaddr = false;
     if (orig_err) {
@@ -2165,6 +2187,7 @@ qemuDomainAttachRNGDevice(virConnectPtr conn,
         virFreeError(orig_err);
     }
 
+    qemuDomainDelTLSObjects(driver, vm, secAlias, tlsAlias);
     goto audit;
 }
 
diff --git a/src/qemu/qemu_hotplug.h b/src/qemu/qemu_hotplug.h
index 0b11c1ed9f..24cf0338ca 100644
--- a/src/qemu/qemu_hotplug.h
+++ b/src/qemu/qemu_hotplug.h
@@ -33,6 +33,19 @@ int qemuDomainChangeEjectableMedia(virQEMUDriverPtr driver,
                                    virDomainDiskDefPtr disk,
                                    virStorageSourcePtr newsrc,
                                    bool force);
+
+void qemuDomainDelTLSObjects(virQEMUDriverPtr driver,
+                             virDomainObjPtr vm,
+                             const char *secAlias,
+                             const char *tlsAlias);
+
+int qemuDomainAddTLSObjects(virQEMUDriverPtr driver,
+                            virDomainObjPtr vm,
+                            const char *secAlias,
+                            virJSONValuePtr *secProps,
+                            const char *tlsAlias,
+                            virJSONValuePtr *tlsProps);
+
 int qemuDomainAttachControllerDevice(virQEMUDriverPtr driver,
                                      virDomainObjPtr vm,
                                      virDomainControllerDefPtr controller);