diff --git a/src/cert-enroll/Makefile.am b/src/cert-enroll/Makefile.am
index f2eb9e6e0..745d7fc80 100644
--- a/src/cert-enroll/Makefile.am
+++ b/src/cert-enroll/Makefile.am
@@ -28,6 +28,8 @@ cert_install_availabledir = $(sysconfdir)/cert-enroll.d/cert-install-available
 cert_install_available_DATA = \
 	cert-install-ssl \
 	cert-install-sssd \
+	cert-install-ldaputils \
+	cert-install-cockpit \
 	cert-install-dirsrv \
 	cert-install-lighttpd \
 	cert-install-openxpki \
@@ -41,9 +43,10 @@ cert-install-ipsec : cert-install-ipsec.in
 
 EXTRA_DIST = \
 	cert-enroll.conf cert-enroll.in cert-enroll.service.in cert-enroll.timer \
-	cert-install-dirsrv cert-install-gitea cert-install-ipsec.in \
-	cert-install-lighttpd cert-install-openxpki cert-install-ssl \
-	cert-install-sssd cert-install-swanctl.in
+	cert-install-cockpit cert-install-dirsrv cert-install-gitea \
+	cert-install-ipsec.in cert-install-ldaputils cert-install-lighttpd \
+	cert-install-openxpki cert-install-ssl cert-install-sssd \
+	cert-install-swanctl.in
 
 man8_MANS = cert-enroll.8
 
diff --git a/src/cert-enroll/cert-enroll.conf b/src/cert-enroll/cert-enroll.conf
index d2b12c82f..ab8a644ba 100644
--- a/src/cert-enroll/cert-enroll.conf
+++ b/src/cert-enroll/cert-enroll.conf
@@ -22,8 +22,10 @@
 : ${CAOUT=cacert}
 : ${ROOTCA=$CAOUT.pem}
 : ${OLDROOTCA=$CAOUT-old.pem}
+: ${OLDERROOTCA=$CAOUT-older.pem}
 : ${SUBCA=$CAOUT-1.pem}
 : ${OLDSUBCA=$CAOUT-1-old.pem}
+: ${OLDERSUBCA=$CAOUT-1-older.pem}
 : ${RAOUT=racert}
 : ${RACERT=$RAOUT.pem}
 
diff --git a/src/cert-enroll/cert-enroll.in b/src/cert-enroll/cert-enroll.in
index 84251a947..71ef7a4e1 100644
--- a/src/cert-enroll/cert-enroll.in
+++ b/src/cert-enroll/cert-enroll.in
@@ -155,6 +155,10 @@ function check_ca_certs()
   if [ $ROOTCA_CHANGED -ne 0 ]
   then
     echo "Warning: '$ROOTCA' has changed"
+    if [ -s old/$ROOTCA ]
+    then
+      mv old/$ROOTCA older
+    fi
     mv $ROOTCA old
     mv new/$ROOTCA .
   fi
@@ -164,6 +168,10 @@ function check_ca_certs()
   if [ $SUBCA_CHANGED -ne 0 ]
   then
     echo "Warning: '$SUBCA' has changed"
+    if [ -s old/$SUBCA ]
+    then
+      mv old/$SUBCA older
+    fi
     mv $SUBCA old
     mv new/$SUBCA .
   fi
@@ -192,6 +200,7 @@ function install_certs()
     KEYTYPE="$KEYTYPE" CERTDIR="$CERTDIR" HOSTKEY="$HOSTKEY" \
     HOSTCERT="$HOSTCERT" ROOTCA="$ROOTCA" SUBCA="$SUBCA" \
     OLDROOTCA="$OLDROOTCA" OLDSUBCA="$OLDSUBCA" \
+    OLDERROOTCA="$OLDERROOTCA" OLDERSUBCA="$OLDERSUBCA" \
     USER_GROUP="$USER_GROUP" SERVICE="$SERVICE" \
     /bin/bash $script || status=$?
     if [ $status -ne 0 ]
@@ -251,7 +260,7 @@ esac
 ##############################################################################
 # Create and change into certificates directory
 #
-mkdir -p $CERTDIR/new $CERTDIR/old
+mkdir -p $CERTDIR/new $CERTDIR/old $CERTDIR/older
 cd $CERTDIR
 echo "  changed into the '$CERTDIR' directory"
 
diff --git a/src/cert-enroll/cert-install-cockpit b/src/cert-enroll/cert-install-cockpit
new file mode 100644
index 000000000..f985ab73e
--- /dev/null
+++ b/src/cert-enroll/cert-install-cockpit
@@ -0,0 +1,50 @@
+#!/bin/bash
+# Install the generated key and certificate as TLS credentials for the Cockpit 
+# management interface.
+#
+# Copyright (C) 2024 Andreas Steffen
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+# THE SOFTWARE.
+#
+set -e
+
+##############################################################################
+# Set local paths 
+#
+
+# Path to the cockpit credentials 
+COCKPIT="/etc/cockpit/ws-certs.d"
+
+##############################################################################
+# Change into the certificates directory
+#
+cd $CERTDIR
+
+##############################################################################
+# Install the private key and certificate
+#
+cp $HOSTKEY  $COCKPIT/ldap.key
+cp $HOSTCERT $COCKPIT/ldap.crt
+
+##############################################################################
+# Restart the cockpit systemd service
+#
+/usr/bin/systemctl restart cockpit.service
+exit 0
+
diff --git a/src/cert-enroll/cert-install-dirsrv b/src/cert-enroll/cert-install-dirsrv
index da196f756..8cffe2b92 100644
--- a/src/cert-enroll/cert-install-dirsrv
+++ b/src/cert-enroll/cert-install-dirsrv
@@ -88,6 +88,16 @@ then
   $CERTUTIL -d . -A -t "CT,," -n "Old Sub CA" -i $CERTDIR/old/$SUBCA \
             -f passwd.txt
 fi
+if [ -s $CERTDIR/older/$ROOTCA ]
+then
+  $CERTUTIL -d . -A -t "CT,," -n "Older Root CA" -i $CERTDIR/older/$ROOTCA \
+            -f passwd.txt
+fi
+if [ -s $CERTDIR/older/$SUBCA ]
+then
+  $CERTUTIL -d . -A -t "CT,," -n "Older Sub CA" -i $CERTDIR/older/$SUBCA \
+            -f passwd.txt
+fi
  
 ##############################################################################
 # Move the generated credentials to the correct place and delete the build dir 
diff --git a/src/cert-enroll/cert-install-ipsec.in b/src/cert-enroll/cert-install-ipsec.in
index 1eea8def0..e50104cae 100644
--- a/src/cert-enroll/cert-install-ipsec.in
+++ b/src/cert-enroll/cert-install-ipsec.in
@@ -53,6 +53,22 @@ cp $HOSTCERT $IPSECDIR/certs
 # Install the CA certificates
 #
 cp $ROOTCA $SUBCA $IPSECDIR/cacerts
+if [ -s old/$ROOTCA ]
+then
+  cp old/$ROOTCA $IPSECDIR/cacerts/$OLDROOTCA
+fi
+if [ -s old/$SUBCA ]
+then
+  cp old/$SUBCA $IPSECDIR/cacerts/$OLDSUBCA
+fi
+if [ -s older/$ROOTCA ]
+then
+  cp older/$ROOTCA $IPSECDIR/cacerts/$OLDERROOTCA
+fi
+if [ -s older/$SUBCA ]
+then
+  cp older/$SUBCA $IPSECDIR/cacerts/$OLDERSUBCA
+fi
 
 ##############################################################################
 # Reload the strongSwan charon daemon if it is running
diff --git a/src/cert-enroll/cert-install-ldaputils b/src/cert-enroll/cert-install-ldaputils
new file mode 100644
index 000000000..90160e4b6
--- /dev/null
+++ b/src/cert-enroll/cert-install-ldaputils
@@ -0,0 +1,64 @@
+#!/bin/bash
+# Concatenate the present and past CA certificates into a single TLS_CACERT
+# file defined by ldap.conf so that the ldap-utils can verify the LDAP server
+# certificate.
+#
+# Copyright (C) 2024 Andreas Steffen
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+# THE SOFTWARE.
+#
+set -e
+
+##############################################################################
+# Set some local paths
+#
+
+# Path to the LDAP configuration file
+LDAP_CONF="/etc/ldap/ldap.conf"
+
+# Extract or set path to the LDAP TLS CA cert directory
+LDAP_TLS_CACERTS=$(awk '/TLS_CACERT/ {print $2}' $LDAP_CONF)
+
+##############################################################################
+# Change into the certificate directory
+#
+cd $CERTDIR
+
+##############################################################################
+# Concatenate the CA certificates into a single file
+#
+cat $ROOTCA $SUBCA > $LDAP_TLS_CACERTS
+if [ -s old/$ROOTCA ]
+then
+  cat old/$ROOTCA >> $LDAP_TLS_CACERTS
+fi
+if [ -s old/$SUBCA ]
+then
+  cat old/$SUBCA >> $LDAP_TLS_CACERTS
+fi
+if [ -s older/$ROOTCA ]
+then
+  cat older/$ROOTCA >> $LDAP_TLS_CACERTS
+fi
+if [ -s older/$SUBCA ]
+then
+  cat older/$SUBCA >> $LDAP_TLS_CACERTS
+fi
+
+exit 0
diff --git a/src/cert-enroll/cert-install-openxpki b/src/cert-enroll/cert-install-openxpki
index 3bed2a9f3..e30aa87a4 100644
--- a/src/cert-enroll/cert-install-openxpki
+++ b/src/cert-enroll/cert-install-openxpki
@@ -54,6 +54,14 @@ if [ -s old/$SUBCA ]
 then
   cp old/$SUBCA $OPENXPKI_TLS/chain/$OLDSUBCA
 fi
+if [ -s older/$ROOTCA ]
+then
+  cp older/$ROOTCA $OPENXPKI_TLS/chain/$OLDERROOTCA
+fi
+if [ -s older/$SUBCA ]
+then
+  cp older/$SUBCA $OPENXPKI_TLS/chain/$OLDERSUBCA
+fi
 
 rm -f $OPENXPKI_TLS/chain/*.0
 
diff --git a/src/cert-enroll/cert-install-ssl b/src/cert-enroll/cert-install-ssl
index 4db7c0b9c..306e661b9 100644
--- a/src/cert-enroll/cert-install-ssl
+++ b/src/cert-enroll/cert-install-ssl
@@ -49,6 +49,14 @@ if [ -s $CERTDIR/old/$SUBCA ]
 then
   cat $CERTDIR/old/$SUBCA  >> $SSL_DIR/trusted.pem
 fi
+if [ -s $CERTDIR/older/$ROOTCA ]
+then
+  cat $CERTDIR/older/$ROOTCA >> $SSL_DIR/trusted.pem
+fi
+if [ -s $CERTDIR/older/$SUBCA ]
+then
+  cat $CERTDIR/older/$SUBCA  >> $SSL_DIR/trusted.pem
+fi
 
 ##############################################################################
 # Restart the systemd service if it is active
diff --git a/src/cert-enroll/cert-install-sssd b/src/cert-enroll/cert-install-sssd
index 260e1440f..ae3d8bd2e 100644
--- a/src/cert-enroll/cert-install-sssd
+++ b/src/cert-enroll/cert-install-sssd
@@ -53,6 +53,14 @@ if [ -s old/$SUBCA ]
 then
   cp old/$SUBCA $LDAP_TLS_CACERTDIR/$OLDSUBCA
 fi
+if [ -s older/$ROOTCA ]
+then
+  cp older/$ROOTCA $LDAP_TLS_CACERTDIR/$OLDERROOTCA
+fi
+if [ -s older/$SUBCA ]
+then
+  cp older/$SUBCA $LDAP_TLS_CACERTDIR/$OLDERSUBCA
+fi
 
 rm -f $LDAP_TLS_CACERTDIR/*.0
 
diff --git a/src/cert-enroll/cert-install-swanctl.in b/src/cert-enroll/cert-install-swanctl.in
index 2b2781d52..ff8aad7d8 100644
--- a/src/cert-enroll/cert-install-swanctl.in
+++ b/src/cert-enroll/cert-install-swanctl.in
@@ -69,6 +69,14 @@ if [ -s old/$SUBCA ]
 then
   cp old/$SUBCA ${SWANCTLDIR}/x509ca/$OLDSUBCA
 fi
+if [ -s older/$ROOTCA ]
+then
+  cp older/$ROOTCA ${SWANCTLDIR}/x509ca/$OLDERROOTCA
+fi
+if [ -s older/$SUBCA ]
+then
+  cp older/$SUBCA ${SWANCTLDIR}/x509ca/$OLDERSUBCA
+fi
 
 ##############################################################################
 # Reload the strongswan systemd service if it is running