def enable_tls_for(template, port, trusted_cert_file):
    """
    Change a deployment template to enable TLS communications.

    @param template: deployment template
    @param port: listening port for Cloudera Manager with TLS enabled
    @param trusted_cert_file: file-like object for trusted certificate
    @rtype: DeploymentTemplate
    @return: updated deployment template
    """
    if template.tls_enabled:
        raise Exception('Error: the deployment %s already has TLS enabled' % template.name)
    template.tls_enabled = True
    template.port = port
    if trusted_cert_file:
        cert_contents = trusted_cert_file.read()
        template.trusted_certificate = cert_contents
    return template