diff --git a/ipasserelle-base.spec b/ipasserelle-base.spec
index d9cad58..468b0bb 100644
--- a/ipasserelle-base.spec
+++ b/ipasserelle-base.spec
@@ -1,4 +1,4 @@
-%define version 0.2.8
+%define version 0.2.9
 %define release 1.beta2
 %define name ipasserelle-base
 
@@ -46,6 +46,9 @@ Based on SMEServer, iPasserelle is a specially configured
 SME Server, with some additionnal modules
 
 %changelog
+* Tue May 29 2012 Daniel Berteaud <daniel@firewall-services.com> 0.2.9-1.sme
+- Update private cacert
+
 * Thu May 24 2012 Daniel Berteaud <daniel@firewall-services.com> 0.2.8-1.sme
 - Use pbzip2 instead of bzip2 for maillog rotation
 
diff --git a/root/etc/e-smith/events/actions/private-cacert b/root/etc/e-smith/events/actions/private-cacert
index 51ceac8..8e26da7 100644
--- a/root/etc/e-smith/events/actions/private-cacert
+++ b/root/etc/e-smith/events/actions/private-cacert
@@ -3,9 +3,9 @@
 # Copy PHPki CAcert in the global cert store
 # and run c_rehash
 
-if [ ! -e /etc/pki/tls/certs/cacert.pem -a -e /opt/phpki/phpki-store/CA/certs/cacert.pem ]; then
-  cp /opt/phpki/phpki-store/CA/certs/cacert.pem /etc/pki/tls/certs/cacert.pem
+if [ -e /opt/phpki/phpki-store/CA/certs/cacert.pem ]; then
+  cp -f /opt/phpki/phpki-store/CA/certs/cacert.pem /etc/pki/tls/certs/cacert.pem
   chmod 644 /etc/pki/tls/certs/cacert.pem
-  c_rehash /etc/pki/tls/certs/
 fi
 
+/usr/bin/c_rehash /etc/pki/tls/certs/