diff --git a/.travis.yml b/.travis.yml
index c425b5cb91..79dec62b3f 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,8 +1,5 @@
-# Used old infrastructure, needed for integration tests:
-# http://docs.travis-ci.com/user/workers/standard-infrastructure/
-sudo: required
-# NOTE: We use precise because tests finish faster than on Xenial
-dist: precise
+os: linux
+dist: xenial
 language: python
 
 branches:
@@ -25,7 +22,7 @@ env:
     - NOSE_TIME=$([ "${TRAVIS_PULL_REQUEST}" = "false" ] && [ "${IS_NIGHTLY_BUILD}" = "no" ] && echo "yes" || echo "no")
     # Travis-specific st2.conf (with travis user instead of stanley)
     - ST2_CONF=conf/st2.travis.conf
-matrix:
+jobs:
   include:
     # NOTE: We combine builds because Travis offers a maximum of 5 concurrent
     # builds and having 6 tasks / builds means 1 tasks will need to wait for one
@@ -34,54 +31,36 @@ matrix:
     # job which also includes "make requirements" and other steps
     # "make requirements" can take substantially lower if the cache is purged
     # and this would cause too many intermediate failures / false positives
+    # NOTE: TASK is inspected in commands below and other travis scripts.
+    # For example, ci-py3* targets trigger an alternate virtualenv build method.
+    # If you rename or reorder make targets in TASK, you may need to adjust:
+    # scripts/travis/install-requirements.sh
+    # scripts/travis/run-nightly-make-task-if-exists.sh
     - env: TASK=ci-unit CACHE_NAME=py2 COMMAND_THRESHOLD=700
       python: 2.7
       name: "Unit Tests (Python 2.7 MongoDB 3.4)"
-    #- env: TASK=ci-unit CACHE_NAME=py2 COMMAND_THRESHOLD=700
-      #python: 2.7
-      #name: "Unit Tests (Python 2.7 MongoDB 3.6)"
-      #addons:
-      #  apt:
-      #    sources:
-      #      - mongodb-upstart
-      #      - sourceline: 'deb [arch=amd64] http://repo.mongodb.org/apt/ubuntu precise/mongodb-org/3.6 multiverse'
-      #        key_url: 'https://www.mongodb.org/static/pgp/server-3.6.asc'
-      #      - sourceline: 'ppa:git-core/ppa'
-      #    packages:
-      #      - mongodb-org-server
-      #      - mongodb-org-shell
-      #      - git
     - env: TASK=ci-integration CACHE_NAME=py2 COMMAND_THRESHOLD=700
       python: 2.7
       name: "Integration Tests (Python 2.7)"
-    - env: TASK="ci-checks ci-packs-tests" CACHE_NAME=py2 COMMAND_THRESHOLD=280
+    - env: TASK="ci-checks ci-packs-tests" CACHE_NAME=py2 COMMAND_THRESHOLD=430
       python: 2.7
       name: "Lint Checks, Packs Tests (Python 2.7)"
-    - env: TASK="compilepy3 ci-py3-unit" CACHE_NAME=py3 COMMAND_THRESHOLD=680
+    - env: TASK="compilepy3 ci-py3-unit ci-py3-packs-tests" CACHE_NAME=py3 PYTHON_VERSION=python3.6 COMMAND_THRESHOLD=750
       python: 3.6
       name: "Unit Tests, Pack Tests (Python 3.6)"
-    - env: TASK="ci-py3-integration" CACHE_NAME=py3 COMMAND_THRESHOLD=310
+    - env: TASK="ci-py3-integration" CACHE_NAME=py3 PYTHON_VERSION=python3.6 COMMAND_THRESHOLD=770
       python: 3.6
       name: "Integration Tests (Python 3.6)"
 
 addons:
   apt:
     sources:
-      - mongodb-upstart
-      - sourceline: 'deb [arch=amd64] http://repo.mongodb.org/apt/ubuntu precise/mongodb-org/3.4 multiverse'
+      - sourceline: 'deb [arch=amd64] http://repo.mongodb.org/apt/ubuntu xenial/mongodb-org/3.4 multiverse'
         key_url: 'https://www.mongodb.org/static/pgp/server-3.4.asc'
-      # NOTE: Precise repo doesn't contain Erlang 20.x, latest version is 19.x so we need to use RabbitMQ 3.7.6
-      #- sourceline: 'deb [arch=amd64] http://packages.erlang-solutions.com/ubuntu precise contrib'
-      #  key_url: 'https://packages.erlang-solutions.com/ubuntu/erlang_solutions.asc'
-      #- sourceline: 'deb [arch=amd64] https://dl.bintray.com/rabbitmq/debian precise rabbitmq-server-v3.6.x'
-      #  key_url: 'https://github.com/rabbitmq/signing-keys/releases/download/2.0/rabbitmq-release-signing-key.asc'
-      - sourceline: 'ppa:git-core/ppa'
     packages:
-      - mongodb-org-server
-      - mongodb-org-shell
-      - erlang
+      - mongodb-org-server=3.4.*
+      - mongodb-org-shell=3.4.*
       - rabbitmq-server
-      - git
       - libffi-dev
 
 cache:
@@ -105,7 +84,8 @@ install:
   # prep a travis-specific dev conf file that uses travis instead of stanley
   - cp conf/st2.dev.conf "${ST2_CONF}" ; sed -i -e "s/stanley/travis/" "${ST2_CONF}"
   - sudo scripts/travis/add-itest-user-key.sh
-  - if [ "${TASK}" = 'ci-unit' ] || [ "${TASK}" = 'ci-integration' ] || [ "${TASK}" = 'ci-checks ci-packs-tests' ] || [ "${TASK}" = 'compilepy3 ci-py3-unit' ] || [ "${TASK}" = 'ci-py3-integration' ]; then sudo .circle/add-itest-user.sh; fi
+  - sudo .circle/add-itest-user.sh
+  - if [[ "${TASK}" = *'-packs-tests'* ]] || [[ "${TASK}" = *'-integration'* ]]; then sudo scripts/travis/permissions-workaround.sh; fi
 
 # Let's enable rabbitmqadmin
 # See https://github.com/messagebus/lapine/wiki/Testing-on-Travis.
@@ -125,7 +105,8 @@ before_script:
   - sudo wget http://guest:guest@localhost:15672/cli/rabbitmqadmin -O /usr/local/bin/rabbitmqadmin
   - sudo chmod +x /usr/local/bin/rabbitmqadmin
   - sudo service rabbitmq-server restart
-  - sudo tail -n 30 /var/log/rabbitmq/*
+  # chmod to make glob work (*.log to avoid log dir)
+  - sudo chmod a+rx /var/log/rabbitmq ; sudo tail -n 30 /var/log/rabbitmq/*.log
   # Print various binary versions
   - mongod --version
   - git --version
diff --git a/Makefile b/Makefile
index b922bcde15..4d68fa4972 100644
--- a/Makefile
+++ b/Makefile
@@ -672,7 +672,7 @@ endif
 		echo "-----------------------------------------------------------"; \
 		. $(VIRTUALENV_DIR)/bin/activate; \
 		    COVERAGE_FILE=.coverage.integration.$$(echo $$component | tr '/' '.') \
-		    nosetests $(NOSE_OPTS) -s -v --exe $(NOSE_COVERAGE_FLAGS) \
+		    nosetests $(NOSE_OPTS) -s -v $(NOSE_COVERAGE_FLAGS) \
 		    $(NOSE_COVERAGE_PACKAGES) \
 		    $$component/tests/integration || exit 1; \
 		echo "-----------------------------------------------------------"; \
@@ -951,6 +951,12 @@ ci-py3-unit:
 	@echo "==================== ci-py3-unit ===================="
 	@echo
 	NOSE_WITH_TIMER=$(NOSE_WITH_TIMER) tox -e py36-unit -vv
+
+.PHONY: ci-py3-packs-tests
+ci-py3-packs-tests:
+	@echo
+	@echo "==================== ci-py3-packs-tests ===================="
+	@echo
 	NOSE_WITH_TIMER=$(NOSE_WITH_TIMER) tox -e py36-packs -vv
 
 .PHONY: ci-py3-unit-nightly
diff --git a/scripts/travis/install-requirements.sh b/scripts/travis/install-requirements.sh
index 8763e014a3..776a998a19 100755
--- a/scripts/travis/install-requirements.sh
+++ b/scripts/travis/install-requirements.sh
@@ -1,8 +1,24 @@
 #!/usr/bin/env bash
 
-if [ "${TASK}" = 'compilepy3 ci-py3-unit' ] || [ "${TASK}" = 'ci-py3-integration' ]; then
+# This file gets run for all travis jobs.
+
+# virtualenv prepartion is different for python3, so we want all py3 targets here.
+# We use a glob instead of listing TASKs so TASK reorganization doesn't require so many changes.
+if [[ " ${TASK}" = *' ci-py3-'* ]]; then
     pip install "tox==3.8.6"
 
+    # NOTE: The makefile only checks to see if the activate script is present.
+    # It does not check if the virtualenv was built with the correct python version.
+    # Since the makefile defaults to python2.7, a 2.7 virtualenv might get cached.
+    # Specifying PYTHON_VERSION in .travis.yml should alleviate that,
+    # but we'll check the version here just to be sure a cached virtualenv doesn't
+    # silently invalidate the tests.
+
+    # cleanup any invalid python2 cache
+    test -d virtualenv/lib/${PYTHON_VERSION} || rm -rf virtualenv/*
+    # rebuild virtualenv if necessary
+    test -f virtualenv/bin/activate || virtualenv --python=${PYTHON_VERSION} virtualenv --no-download
+
     # Install runners
     . virtualenv/bin/activate
 
@@ -17,15 +33,23 @@ if [ "${TASK}" = 'compilepy3 ci-py3-unit' ] || [ "${TASK}" = 'ci-py3-integration
     # NOTE: We create the environment and install the dependencies first. This
     # means that the subsequent tox build / test command has a stable run time
     # since it doesn't depend on dependencies being installed.
-    if [ "${TASK}" = 'compilepy3 ci-py3-unit' ]; then
-        TOX_TASK="py36-unit"
+    # NOTE: Travis jobs can have more than one TASK, so we search for all make
+    # targets that need a tox env. The spaces ensure we match entire make targets.
+    if [[ " ${TASK} " = *' ci-py3-unit '* ]]; then
+        tox -e py36-unit --notest
     fi
 
-    if [ "${TASK}" = 'ci-py3-integration' ]; then
-        TOX_TASK="py36-integration"
+    if [[ " ${TASK} " = *' ci-py3-unit-nightly '* ]]; then
+        tox -e py36-unit-nightly --notest
     fi
 
-    tox -e ${TOX_TASK} --notest
+    if [[ " ${TASK} " = *' ci-py3-packs-tests '* ]]; then
+        tox -e py36-packs --notest
+    fi
+
+    if [[ " ${TASK} " = *' ci-py3-integration '* ]]; then
+        tox -e py36-integration --notest
+    fi
 else
     make requirements
 fi
diff --git a/scripts/travis/permissions-workaround.sh b/scripts/travis/permissions-workaround.sh
new file mode 100755
index 0000000000..f8f06b8432
--- /dev/null
+++ b/scripts/travis/permissions-workaround.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+set -e
+
+if [ "$(whoami)" != 'root' ]; then
+    echo 'Please run with sudo'
+    exit 2
+fi
+
+# rabbitmq user needs access to the ssl_certs fixtures during integration tests
+# stanley needs to work with packs fixtures during the packs tests
+# this can't be the travis user because 'stanley' is the hardcoded user in the tests
+# o=other; X=only set execute bit if user execute bit is set (eg on dirs)
+chmod -R o+rX ${TRAVIS_BUILD_DIR}/st2tests/st2tests/fixtures ${TRAVIS_BUILD_DIR}/contrib
+
+# make sure parent directories are traversable
+d=${TRAVIS_BUILD_DIR}/st2tests/st2tests
+while [[ "${d}" != "/" ]]; do
+    chmod o+rx "${d}"
+    d=$(dirname "${d}")
+done
diff --git a/scripts/travis/rabbitmq.config b/scripts/travis/rabbitmq.config
index 0cf25a732a..d23be26ec5 100644
--- a/scripts/travis/rabbitmq.config
+++ b/scripts/travis/rabbitmq.config
@@ -1,7 +1,6 @@
 [
   {rabbit, [
      {ssl_listeners, [5671]},
-     {ssl_allow_poodle_attack, true},
      {ssl_options, [{cacertfile, "/home/travis/build/StackStorm/st2/st2tests/st2tests/fixtures/ssl_certs/ca/ca_certificate_bundle.pem"},
                     {certfile,   "/home/travis/build/StackStorm/st2/st2tests/st2tests/fixtures/ssl_certs/server/server_certificate.pem"},
                     {keyfile,    "/home/travis/build/StackStorm/st2/st2tests/st2tests/fixtures/ssl_certs/server/private_key.pem"},
diff --git a/st2common/tests/integration/test_rabbitmq_ssl_listener.py b/st2common/tests/integration/test_rabbitmq_ssl_listener.py
index ee5de6b92f..49b1f3c2d7 100644
--- a/st2common/tests/integration/test_rabbitmq_ssl_listener.py
+++ b/st2common/tests/integration/test_rabbitmq_ssl_listener.py
@@ -39,10 +39,7 @@
 
 # NOTE: We only run those tests on Travis because at the moment, local vagrant dev VM doesn't
 # expose RabbitMQ SSL listener by default
-# TODO: Re-enable once we upgrade Travis from Precise to Xenial where latest version of RabbitMQ
-# and OpenSSL is available
-@unittest2.skip('Skipping until we upgrade to Xenial on Travis')
-# @unittest2.skipIf(not ON_TRAVIS, 'Skipping tests because not running on Travis')
+@unittest2.skipIf(not ON_TRAVIS, 'Skipping tests because not running on Travis')
 class RabbitMQTLSListenerTestCase(unittest2.TestCase):
 
     def setUp(self):
@@ -56,16 +53,18 @@ def setUp(self):
     def test_non_ssl_connection_on_ssl_listener_port_failure(self):
         connection = transport_utils.get_connection(urls='amqp://guest:guest@127.0.0.1:5671/')
 
-        expected_msg_1 = '[Errno 104] Connection reset by peer'
+        expected_msg_1 = '[Errno 104]'  # followed by: ' Connection reset by peer' or ' ECONNRESET'
         expected_msg_2 = 'Socket closed'
+        expected_msg_3 = 'Server unexpectedly closed connection'
 
         try:
             connection.connect()
         except Exception as e:
             self.assertFalse(connection.connected)
             self.assertIsInstance(e, (IOError, socket.error))
-            self.assertTrue(expected_msg_1 in six.text_type(e) or expected_msg_2 in
-                            six.text_type(e))
+            self.assertTrue(expected_msg_1 in six.text_type(e) or
+                            expected_msg_2 in six.text_type(e) or
+                            expected_msg_3 in six.text_type(e))
         else:
             self.fail('Exception was not thrown')
 
diff --git a/tox.ini b/tox.ini
index 3832b40c02..4e6070fe5a 100644
--- a/tox.ini
+++ b/tox.ini
@@ -93,15 +93,15 @@ deps = virtualenv
        -e{toxinidir}/st2client
        -e{toxinidir}/st2common
 commands =
-    nosetests --rednose --immediate -sv --exe st2actions/tests/integration/
-    nosetests --rednose --immediate -sv --exe st2api/tests/integration/
-    nosetests --rednose --immediate -sv --exe st2common/tests/integration/
-    nosetests --rednose --immediate -sv --exe st2debug/tests/integration/
-    nosetests --rednose --immediate -sv --exe st2exporter/tests/integration/
-    nosetests --rednose --immediate -sv --exe st2reactor/tests/integration/
-    nosetests --rednose --immediate -sv --exe contrib/runners/action_chain_runner/tests/integration/
-    nosetests --rednose --immediate -sv --exe contrib/runners/local_runner/tests/integration/
-    nosetests --rednose --immediate -sv --exe contrib/runners/mistral_v2/tests/integration/
-    nosetests --rednose --immediate -sv --exe contrib/runners/orquesta_runner/tests/integration/
-    nosetests --rednose --immediate -sv --exe st2tests/integration/orquesta/
-    nosetests --rednose --immediate -sv --exe contrib/runners/python_runner/tests/integration/
+    nosetests --rednose --immediate -sv st2actions/tests/integration/
+    nosetests --rednose --immediate -sv st2api/tests/integration/
+    nosetests --rednose --immediate -sv st2common/tests/integration/
+    nosetests --rednose --immediate -sv st2debug/tests/integration/
+    nosetests --rednose --immediate -sv st2exporter/tests/integration/
+    nosetests --rednose --immediate -sv st2reactor/tests/integration/
+    nosetests --rednose --immediate -sv contrib/runners/action_chain_runner/tests/integration/
+    nosetests --rednose --immediate -sv contrib/runners/local_runner/tests/integration/
+    nosetests --rednose --immediate -sv contrib/runners/mistral_v2/tests/integration/
+    nosetests --rednose --immediate -sv contrib/runners/orquesta_runner/tests/integration/
+    nosetests --rednose --immediate -sv st2tests/integration/orquesta/
+    nosetests --rednose --immediate -sv contrib/runners/python_runner/tests/integration/