diff --git a/bootstrap.go b/bootstrap.go
index b4ad15e..069a314 100644
--- a/bootstrap.go
+++ b/bootstrap.go
@@ -115,6 +115,9 @@ func bootstrap(cfg *config.Config) {
 		log.Print("setting root's authorized keys")
 		setAuthorizedKeys(ak)
 	}
+
+	// update-ca-certificates
+	run("chroot", "/system", "update-ca-certificates")
 }
 
 func setUserPass(user, passwordHash string) {