diff --git a/compose/services.yml b/compose/services.yml
index 5965a28..e06774b 100644
--- a/compose/services.yml
+++ b/compose/services.yml
@@ -26,7 +26,7 @@ services:
       DB_USER: docker
       DELTA_HOST: delta.${OPENBALENA_HOST_NAME}
       DEVICE_CONFIG_OPENVPN_CONFIG: ${OPENBALENA_VPN_CONFIG}
-      DEVICE_CONFIG_OPENVPN_CA: ${OPENBALENA_VPN_CA}
+      DEVICE_CONFIG_OPENVPN_CA: ${OPENBALENA_VPN_CA_CHAIN}
       DEVICE_CONFIG_SSH_AUTHORIZED_KEYS: ${OPENBALENA_SSH_AUTHORIZED_KEYS}
       HOST: api.${OPENBALENA_HOST_NAME}
       IMAGE_MAKER_URL: img.${OPENBALENA_HOST_NAME}
diff --git a/scripts/make-env b/scripts/make-env
index 53bd4a4..55cce30 100755
--- a/scripts/make-env
+++ b/scripts/make-env
@@ -76,6 +76,7 @@ export OPENBALENA_TOKEN_AUTH_PUB=$(b64encode "$JWT_CRT")
 export OPENBALENA_TOKEN_AUTH_KEY=$(b64encode "$JWT_KEY")
 export OPENBALENA_TOKEN_AUTH_KID=$(b64encode "$JWT_KID")
 export OPENBALENA_VPN_CA=$(b64encode "$VPN_CA")
+export OPENBALENA_VPN_CA_CHAIN=$(b64encode "$ROOT_CA" "$VPN_CA")
 export OPENBALENA_VPN_CONFIG=$VPN_CONFIG
 export OPENBALENA_VPN_SERVER_CRT=$(b64encode "$VPN_CRT")
 export OPENBALENA_VPN_SERVER_KEY=$(b64encode "$VPN_KEY")