diff --git a/README.md b/README.md
index d549fee..6280098 100644
--- a/README.md
+++ b/README.md
@@ -6,11 +6,12 @@
 
 ### Environnement variable
 
-| Variable             | Default Value    | Usage                                       |
-|----------------------|------------------|---------------------------------------------|
-| PIP_REQUIREMENTS     | requirements.txt | install python library requirements         |
-| ANSIBLE_REQUIREMENTS | requirements.yml | install ansible galaxy roles requirements   |
-| DEPLOY_KEY           |                  | pass an SSH private key to use in container |
+| Variable             | Default Value    | Usage                                           |
+|----------------------|------------------|-------------------------------------------------|
+| PIP_REQUIREMENTS     | requirements.txt | install python library requirements             |
+| ANSIBLE_REQUIREMENTS | requirements.yml | install ansible galaxy roles requirements       |
+| DEPLOY_KEY           |                  | pass an SSH private key to use in container     |
+| CA_CERT_UPGRADE      |                  | set to `true` to update ca-certificates package |
 
 ### Mitogen
 
@@ -23,7 +24,7 @@ strategy = mitogen_linear
 
 ### Run Playbook
 
-```
+```sh
 docker run -it --rm \
   -v ${PWD}:/ansible \
   pad92/ansible-alpine:latest \
@@ -32,7 +33,7 @@ docker run -it --rm \
 
 ### Generate Base Role structure
 
-```
+```sh
 docker run -it --rm \
   -v ${PWD}:/ansible \
   pad92/ansible-alpine:latest \
@@ -41,13 +42,14 @@ docker run -it --rm \
 
 ### Lint Role
 
-```
+```sh
 docker run -it --rm pad92/ansible-alpine:latest \
   -v ${PWD}:/ansible ansible-playbook tests/playbook.yml --syntax-check
 ```
+
 ### Run with forwarding ssh agent
 
-```
+```sh
 docker run -it --rm \
   -v $(readlink -f $SSH_AUTH_SOCK):/ssh-agent \
   -v ${PWD}:/ansible \
@@ -55,3 +57,14 @@ docker run -it --rm \
   pad92/ansible-alpine:latest \
   sh
 ```
+
+### add custom certifitates
+
+```sh
+docker run -it --rm \
+  -v $(readlink -f $SSH_AUTH_SOCK):/ssh-agent \
+  -v ${PWD}:/ansible \
+  -v ${PWD}/ca-certificates:/usr/local/share/ca-certificates
+  -e SSH_AUTH_SOCK=/ssh-agent \
+  pad92/ansible-alpine:2.10.7-1 sh
+```
diff --git a/entrypoint b/entrypoint
index 09c990a..bcfc6cc 100755
--- a/entrypoint
+++ b/entrypoint
@@ -15,43 +15,58 @@
 
 # Rotate ansible log if exist
 if [ -f "ansible.log" ]; then
-    DATE_LOG=$(date -d "$(head -1 ansible.log  | cut -d, -f1 )" +%Y%m%d-%H%M%S) 2>/dev/null
-    if [ -n "$DATE_LOG" ]; then
-        mv ansible.log ansible-${DATE_LOG}.log
-        gzip ansible-${DATE_LOG}.log &
-    fi
+  DATE_LOG=$(date -d "$(head -1 ansible.log  | cut -d, -f1 )" +%Y%m%d-%H%M%S) 2>/dev/null
+  if [ -n "${DATE_LOG}" ]; then
+    mv ansible.log ansible-${DATE_LOG}.log
+    gzip ansible-${DATE_LOG}.log &
+  fi
 fi
 
 # Optional deploy key
-if [ ! -z "$DEPLOY_KEY" ] && [ ! -f "/root/.ssh/id_rsa" ]; then
-    mkdir -p /root/.ssh/
-    echo "${DEPLOY_KEY}" > /root/.ssh/id_rsa
-    chmod 0600 /root/.ssh/id_rsa
+if [ ! -z "${DEPLOY_KEY}" ] && [ ! -f "/root/.ssh/id_rsa" ]; then
+  mkdir -p /root/.ssh/
+  echo "${DEPLOY_KEY}" > /root/.ssh/id_rsa
+  chmod 0600 /root/.ssh/id_rsa
 fi
 
 # Loadkey into ssh-agent if key exist
 if [ -f "/root/.ssh/id_rsa" ]; then
-    eval $(ssh-agent)
-    ssh-add /root/.ssh/id_rsa
+  eval $(ssh-agent)
+  ssh-add /root/.ssh/id_rsa
 fi
 
 # install pip requirements, if any
-if [ -z "$PIP_REQUIREMENTS" ]; then
-    PIP_REQUIREMENTS=requirements.txt
+if [ -z "${PIP_REQUIREMENTS}" ]; then
+  PIP_REQUIREMENTS='requirements.txt'
 fi
 
-if [ -f "$PIP_REQUIREMENTS" ]; then
-    pip3 install --upgrade -r $PIP_REQUIREMENTS
+if [ -f "${PIP_REQUIREMENTS}" ]; then
+  pip3 install --upgrade -r $PIP_REQUIREMENTS
 fi
 
-
 # install Galaxy roles, if any
-if [ -z "$ANSIBLE_REQUIREMENTS" ]; then
-    ANSIBLE_REQUIREMENTS=requirements.yml
+if [ -z "${ANSIBLE_REQUIREMENTS}" ]; then
+  ANSIBLE_REQUIREMENTS='requirements.yml'
+fi
+
+if [ -f "${ANSIBLE_REQUIREMENTS}" ]; then
+  ansible-galaxy install $ANSIBLE_GALAXY_PARAM -r $ANSIBLE_REQUIREMENTS
+fi
+
+# upgrade ca-certificates package
+if [ "x${CA_CERT_UPGRADE}" == "xtrue" ]; then
+  apk add --upgrade --no-cache ca-certificates
+fi
+
+# export REQUESTS_CA_BUNDLE
+if [ -z "${REQUESTS_CA_BUNDLE}" ]; then
+  REQUESTS_CA_BUNDLE='/etc/ssl/certs/ca-certificates.crt'
 fi
+export REQUESTS_CA_BUNDLE="${REQUESTS_CA_BUNDLE}"
 
-if [ -f "$ANSIBLE_REQUIREMENTS" ]; then
-    ansible-galaxy install $ANSIBLE_GALAXY_PARAM -r $ANSIBLE_REQUIREMENTS
+# update ca-certs
+if [ "$(find -type f -name '*.crt' /usr/local/share/ca-certificates/ 2>/dev/null | wc -l)" -gt "0" ]; then
+  update-ca-certificates
 fi
 
 exec "$@"
diff --git a/hooks/build b/hooks/build
index b587138..d2f2b01 100755
--- a/hooks/build
+++ b/hooks/build
@@ -5,4 +5,4 @@ docker build --build-arg VCS_REF=`git rev-parse --short HEAD` \
              --build-arg BUILD_DATE=`date -u +”%Y-%m-%dT%H:%M:%SZ”` \
              --build-arg ANSIBLE_VERSION=${ANSIBLE_VERSION:=2.10.7} \
              --build-arg ANSIBLE_LINT_VERSION=${ANSIBLE_LINT_VERSION:=5.1.3} \
-             -t ${IMAGE_NAME:=pad92/ansible-alpine:2.10.7-1} .
+             -t ${IMAGE_NAME:=pad92/ansible-alpine:2.10.7-2} .