diff --git a/ansible/playbooks/openvpn-phone.yml b/ansible/playbooks/openvpn-phone.yml
index e93af19..dd031a3 100644
--- a/ansible/playbooks/openvpn-phone.yml
+++ b/ansible/playbooks/openvpn-phone.yml
@@ -302,6 +302,15 @@
         state: started
         enabled: true
 
+    - name: Read the server certificate for the profile CA block
+      # client-режим ics-openvpn отказывается собирать конфиг без <ca>.
+      # Серверный самоподписанный сертификат сам себе trust anchor; реальную
+      # проверку всё равно делает peer-fingerprint.
+      ansible.builtin.slurp:
+        src: "{{ phone_openvpn_server_cert }}"
+      register: phone_openvpn_server_cert_raw
+      no_log: true
+
     - name: Read the client certificate for the profile
       ansible.builtin.slurp:
         src: "{{ phone_openvpn_client_cert }}"
@@ -342,6 +351,9 @@
           resolv-retry infinite
           nobind
           verb 3
+          <ca>
+          {{ phone_openvpn_server_cert_raw.content | b64decode | trim }}
+          </ca>
           <cert>
           {{ phone_openvpn_client_cert_raw.content | b64decode | trim }}
           </cert>