[Unit]
Description=Rebuild CA Certificates Database
ConditionNeedsUpdate=|/etc
ConditionFileNotEmpty=|!/etc/ssl/certs/ca-certificates.crt
ConditionDirectoryNotEmpty=|/etc/ssl/certs/

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/sbin/update-ca-certificates --fresh
TimeoutSec=30s

[Install]
WantedBy=default.target
