diff --git a/doc/source/operations/upgrading-openstack.rst b/doc/source/operations/upgrading-openstack.rst
index 45145e2e85..bac921268b 100644
--- a/doc/source/operations/upgrading-openstack.rst
+++ b/doc/source/operations/upgrading-openstack.rst
@@ -72,12 +72,14 @@ version of the playbook ``secret-store-generate-internal-tls.yml`` before runnin
 
 After running the playbook, check if the following files are generated.
 
+* ``$KAYOBE_CONFIG_PATH/kolla/certificates/ca/root.crt``
 * ``$KAYOBE_CONFIG_PATH/kolla/certificates/proxysql-cert.pem``
 * ``$KAYOBE_CONFIG_PATH/kolla/certificates/proxysql-key.pem``
 * ``$KAYOBE_CONFIG_PATH/kolla/certificates/proxysql-ca.pem``
 
 If Kayobe environment is used, check these paths.
 
+* ``$KAYOBE_CONFIG_PATH/environments/$KAYOBE_ENVIRONMENT/kolla/certificates/ca/root.crt``
 * ``$KAYOBE_CONFIG_PATH/environments/$KAYOBE_ENVIRONMENT/kolla/certificates/proxysql-cert.pem``
 * ``$KAYOBE_CONFIG_PATH/environments/$KAYOBE_ENVIRONMENT/kolla/certificates/proxysql-key.pem``
 * ``$KAYOBE_CONFIG_PATH/environments/$KAYOBE_ENVIRONMENT/kolla/certificates/proxysql-ca.pem``
diff --git a/etc/kayobe/ansible/secret-store/secret-store-generate-internal-tls.yml b/etc/kayobe/ansible/secret-store/secret-store-generate-internal-tls.yml
index 2e808dcc72..1b00f37de9 100644
--- a/etc/kayobe/ansible/secret-store/secret-store-generate-internal-tls.yml
+++ b/etc/kayobe/ansible/secret-store/secret-store-generate-internal-tls.yml
@@ -51,8 +51,11 @@
     - name: Copy root CA
       ansible.builtin.copy:
         src: "{{ kayobe_env_config_path }}/{{ stackhpc_ca_secret_store }}/OS-TLS-ROOT.pem"
-        dest: "{{ kayobe_env_config_path }}/kolla/certificates/ca/{{ stackhpc_ca_secret_store }}.crt"
+        dest: "{{ item }}"
         mode: "0600"
+      loop:
+        - "{{ kayobe_env_config_path }}/kolla/certificates/ca/{{ stackhpc_ca_secret_store }}.crt"
+        - "{{ kayobe_env_config_path }}/kolla/certificates/ca/root.crt"
       delegate_to: localhost
 
 # NOTE(seunghun1ee): Kolla Ansible reuses internal TLS certificate when