diff --git a/roles/pki-install/handlers/main.yml b/roles/pki-install/handlers/main.yml
new file mode 100644
index 0000000..409ab0f
--- /dev/null
+++ b/roles/pki-install/handlers/main.yml
@@ -0,0 +1,16 @@
+---
+# pki-install/handlers/main.yml
+
+- name: Run update-ca-certificates on head node
+  become: yes
+  command: update-ca-certificates
+
+- name: Copy root CA cert to all service VMs
+  command: ansible services -b -u ubuntu -m copy -a "src=/usr/local/share/ca-certificates/cord_root_ca.crt dest=/usr/local/share/ca-certificates/cord_root_ca.crt owner=root group=root mode=0644"
+
+- name: Copy intermediate CA cert to all service VMs
+  command: ansible services -b -u ubuntu -m copy -a "src=/usr/local/share/ca-certificates/cord_intermediate_ca.crt dest=/usr/local/share/ca-certificates/cord_intermediate_ca.crt owner=root group=root mode=0644"
+
+- name: update-ca-certificates in service VMs
+  command: ansible services -b -u ubuntu -m command -a "update-ca-certificates"
+
diff --git a/roles/pki-install/tasks/main.yml b/roles/pki-install/tasks/main.yml
new file mode 100644
index 0000000..136b8c7
--- /dev/null
+++ b/roles/pki-install/tasks/main.yml
@@ -0,0 +1,18 @@
+---
+# pki-install/tasks/main.yml
+
+- name: Copy CA certificates to head node
+  become: yes
+  copy:
+    src: "{{ playbook_dir }}/pki/{{ item.src }}"
+    dest: "/usr/local/share/ca-certificates/{{ item.dest }}"
+  with_items:
+    - src: "root_ca/certs/ca_cert.pem"
+      dest: "cord_root_ca.crt"
+    - src: "intermediate_ca/certs/im_cert.pem"
+      dest: "cord_intermediate_ca.crt"
+  notify:
+    - Run update-ca-certificates on head node
+    - Copy root CA cert to all service VMs
+    - Copy intermediate CA cert to all service VMs
+    - update-ca-certificates in service VMs