diff --git a/tasks/certificate_from_private_ca.yml b/tasks/certificate_from_private_ca.yml
index f95f19a..ec9ea6f 100644
--- a/tasks/certificate_from_private_ca.yml
+++ b/tasks/certificate_from_private_ca.yml
@@ -7,6 +7,7 @@
         ansible_common_remote_group: ansible
 
     - name: Create the certificate (delegate to the CA vm)
+      become_user: root
       ansible.builtin.command:
         cmd: mkcert -cert-file /srv/mkcert-ca/{{ mkcert_cert_name }} -key-file /srv/mkcert-ca/{{ mkcert_key_name }} {{ mkcert_dsn_and_ip_list }}
       args: