diff --git a/install-ca-cert.sh b/install-ca-cert.sh
index 9623622..b233227 100755
--- a/install-ca-cert.sh
+++ b/install-ca-cert.sh
@@ -26,6 +26,17 @@ else
     RUNNING_AS_ROOT=false
 fi
 
+# Check for certutil
+if ! command -v certutil &> /dev/null; then
+    echo "⚠ certutil not found, installing libnss3-tools..."
+    if [ "$RUNNING_AS_ROOT" = true ]; then
+        apt-get update && apt-get install -y libnss3-tools
+    else
+        $SUDO apt-get update && $SUDO apt-get install -y libnss3-tools
+    fi
+    echo ""
+fi
+
 # Step 1: Download CA certificate from UCS server
 echo "[1/5] Downloading CA certificate from UCS server..."
 scp root@${UCS_SERVER}:/etc/univention/ssl/ucsCA/CAcert.pem "$TEMP_CERT"