diff --git a/TODO b/TODO
index a880236..4f386b6 100644
--- a/TODO
+++ b/TODO
@@ -7,4 +7,3 @@
 - automatically setup doorlock user
 - automatically deploy nginx
 - unclutter stuff for X (hide cursor)
-- certificates are still an issue
diff --git a/arch/PKGBUILD b/arch/PKGBUILD
index a9a3e50..d763481 100644
--- a/arch/PKGBUILD
+++ b/arch/PKGBUILD
@@ -8,15 +8,21 @@ arch=('any')
 url="https://github.com/Binary-Kitchen/${pkgname}"
 license=(GPL)
 depends=('python3' 'python-ldap' 'alsa-utils' 'mosquitto' 'wol' 'python-flask-wtf' 'python-flask-socketio')
-source=("git+https://github.com/Binary-Kitchen/${pkgname}.git#branch=next")
-sha256sums=('SKIP')
+source=("git+https://github.com/Binary-Kitchen/${pkgname}.git#branch=next"
+        "https://www.binary-kitchen.de/static/BKCA.crt")
+sha256sums=('SKIP'
+            '2e8b1ffabcf16e3e60cfc277b40955ae499dedcf39762efbb0512003be9db10f')
 
 build() {
   cd "$srcdir/$pkgname/"
   make PREFIX=/usr sysconfdir=/etc
+  cp -v ../BKCA.crt .
 }
 
 package() {
+  install=${pkgname}.install
   cd "$srcdir/$pkgname/"
   make PREFIX=/usr sysconfdir=/etc DESTDIR="$pkgdir" install
+  mkdir -p $pkgdir/etc/ca-certificates/trust-source/anchors
+  cp -v BKCA.crt $pkgdir/etc/ca-certificates/trust-source/anchors
 }
diff --git a/arch/doorlockd.install b/arch/doorlockd.install
new file mode 100644
index 0000000..37e6d00
--- /dev/null
+++ b/arch/doorlockd.install
@@ -0,0 +1,9 @@
+post_install() {
+	echo "Running trust extract-compat"
+	trust extract-compat
+}
+
+post_remove() {
+	echo "Running trust extract-compat"
+	trust extract-compat
+}