diff --git a/ansible/roles/firstboot/files/ansible_payload/bootstrap/roles/metacluster/tasks/certauthority.yml b/ansible/roles/firstboot/files/ansible_payload/bootstrap/roles/metacluster/tasks/certauthority.yml
index d421837..9eea057 100644
--- a/ansible/roles/firstboot/files/ansible_payload/bootstrap/roles/metacluster/tasks/certauthority.yml
+++ b/ansible/roles/firstboot/files/ansible_payload/bootstrap/roles/metacluster/tasks/certauthority.yml
@@ -6,10 +6,10 @@
         chart_ref: /opt/metacluster/helm-charts/step-certificates
         release_namespace: step-ca
         create_namespace: yes
-        # Unable to use REST api based readycheck due to missing ingress
+        # Unable to use REST api based readycheck due to 'missing' ingress
         wait: yes
         kubeconfig: "{{ kubeconfig.path }}"
-        values: "{{ components.stepcertificates.chart_values }}"
+        values: "{{ stepca_values.stdout }}"
 
     - name: Retrieve configmap w/ root certificate
       kubernetes.core.k8s_info:
diff --git a/ansible/roles/firstboot/files/ansible_payload/bootstrap/roles/metacluster/tasks/init.yml b/ansible/roles/firstboot/files/ansible_payload/bootstrap/roles/metacluster/tasks/init.yml
index 18e9b58..b3e812b 100644
--- a/ansible/roles/firstboot/files/ansible_payload/bootstrap/roles/metacluster/tasks/init.yml
+++ b/ansible/roles/firstboot/files/ansible_payload/bootstrap/roles/metacluster/tasks/init.yml
@@ -11,3 +11,45 @@
     - ingress
     - registry
     - storage
+
+- name: Initialize tempfile
+  ansible.builtin.tempfile:
+    state: file
+  register: stepca_password
+
+- name: Store password in tempfile
+  ansible.builtin.copy:
+    dest: "{{ stepca_password.path }}"
+    content: "{{ vapp['metacluster.password'] }}"
+  no_log: true
+
+- name: Generate root CA
+  ansible.builtin.shell:
+    cmd: >-
+      step ca init \
+        --helm \
+        --deployment-type=standalone \
+        --name=ca.{{ vapp['metacluster.fqdn'] }} \
+        --dns=ca.{{ vapp['metacluster.fqdn'] }} \
+        --dns=step-certificates.step-ca.svc.cluster.local \
+        --dns=127.0.0.1 \
+        --address=:443 \
+        --provisioner=admin \
+        --acme \
+        --password-file={{ stepca_password.path }}
+  register: stepca_helmvalues
+
+- name: Cleanup tempfile
+  ansible.builtin.file:
+    path: "{{ stepca_password.path }}"
+    state: absent
+  when: stepca_password.path is defined
+
+- name: Store root CA certificate
+  ansible.builtin.copy:
+    dest: /usr/local/share/ca-certificates/root_ca.crt
+    content: "{{ (stepca_values.stdout | from_yaml).inject.certificates.root_ca }}"
+
+- name: Update certificate truststore
+  ansible.builtin.command:
+    cmd: update-ca-certificates
diff --git a/ansible/vars/metacluster.yml b/ansible/vars/metacluster.yml
index 70cd34c..722e303 100644
--- a/ansible/vars/metacluster.yml
+++ b/ansible/vars/metacluster.yml
@@ -183,7 +183,6 @@ components:
 
   step-certificates:
     helm:
-      # version: 1.18.2+20220324
       version: 1.23.0
       chart: smallstep/step-certificates
       parse_logic: helm template . | yq --no-doc eval '.. | .image? | select(.)' | sed '/:/!s/$/:latest/' | sort -u
diff --git a/packer/vsphere.auto.pkrvars.hcl b/packer/vsphere.auto.pkrvars.hcl
index 5c0e322..5329ad1 100644
--- a/packer/vsphere.auto.pkrvars.hcl
+++ b/packer/vsphere.auto.pkrvars.hcl
@@ -1,9 +1,9 @@
 vcenter_server         = "bv11-vc.bessems.lan"
 vsphere_username       = "administrator@vsphere.local"
 vsphere_datacenter     = "DeSchakel"
-vsphere_cluster        = "Cluster.Legacy"
-vsphere_host           = "bv11-esx.bessems.lan"
-vsphere_datastore      = "ESX00.SSD01"
+vsphere_cluster        = "Cluster.01"
+vsphere_host           = "bv11-esx01.bessems.lan"
+vsphere_datastore      = "ESX01.SSD02"
 vsphere_folder         = "/Packer"
 vsphere_templatefolder = "/Templates"
 vsphere_network        = "LAN"