diff --git a/manifests/init.pp b/manifests/init.pp
index 0c974638d..f31950e89 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -445,8 +445,8 @@ class nova(
   $ca_file                                = false,
   $cert_file                              = false,
   $key_file                               = false,
-  Optional[Hash] $nova_public_key         = undef,
-  Optional[Hash] $nova_private_key        = undef,
+  Nova::SshKey $nova_public_key           = undef,
+  Nova::SshKey $nova_private_key          = undef,
   $ssl_only                               = $facts['os_service_default'],
   $cert                                   = $facts['os_service_default'],
   $key                                    = $facts['os_service_default'],
diff --git a/spec/type_aliases/sshkey_spec.rb b/spec/type_aliases/sshkey_spec.rb
new file mode 100644
index 000000000..8a05be623
--- /dev/null
+++ b/spec/type_aliases/sshkey_spec.rb
@@ -0,0 +1,37 @@
+require 'spec_helper'
+
+describe 'Nova::SshKey' do
+  describe 'valid types' do
+    context 'with valid types' do
+      [
+        {'key' => 'foo'},
+        {'type' => 'bar'},
+        {'key' => 'foo', 'type' => 'bar'},
+        {},
+      ].each do |value|
+        describe value.inspect do
+          it { is_expected.to allow_value(value) }
+        end
+      end
+    end
+  end
+
+  describe 'invalid types' do
+    context 'with garbage inputs' do
+      [
+        {'key' => 1},
+        {'fookey' => 'foo'},
+        'foo',
+        true,
+        false,
+        1,
+        1.1,
+        '<SERVICE DEFAULT>',
+      ].each do |value|
+        describe value.inspect do
+          it { is_expected.not_to allow_value(value) }
+        end
+      end
+    end
+  end
+end
diff --git a/types/sshkey.pp b/types/sshkey.pp
new file mode 100644
index 000000000..b14f36e17
--- /dev/null
+++ b/types/sshkey.pp
@@ -0,0 +1 @@
+type Nova::SshKey = Optional[Hash[Enum['key', 'type'], String[1]]]