diff --git a/.drone.yml b/.drone.yml
index 8a12415..75f5ae7 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -24,7 +24,7 @@ steps:
     cat << EOF > infect.sh
     #! /usr/bin/env bash
 
-    export STAGING_ACME=false
+    export STAGING_ACME=true
     EOF
   - echo "curl https://git.selfprivacy.org/SelfPrivacy/selfprivacy-nixos-infect/raw/branch/$INFECT_SOURCE_BRANCH/nixos-infect | PROVIDER=hetzner DOMAIN=$DOMAIN LUSER=cicdcicd USER_PASS=\"$USER_PASS\" DNS_PROVIDER_TOKEN=$CLOUDFLARE_TOKEN DNS_PROVIDER_TYPE=CLOUDFLARE DB_PASSWORD=\"$USER_PASS\" API_TOKEN=\"$USER_PASS\" HOSTNAME=selfprivacy-ci-test NIX_VERSION=2.18.1 NIXOS_CONFIG_NAME=sp-nixos CONFIG_URL=https://git.selfprivacy.org/api/v1/repos/SelfPrivacy/selfprivacy-nixos-template/archive/master.tar.gz SSH_AUTHORIZED_KEY=\"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMBb3yVhYF4slhf1iQCiGLOVcbGKP/MmkQiEMl2un+4K\" bash 2>&1 | tee /root/infect.log" >> infect.sh
   - http -v --check-status --ignore-stdin POST https://api.hetzner.cloud/v1/servers Authorization:"Bearer $PASSWORD" name=ci-sibling server_type=cx11 start_after_create:=true image=ubuntu-20.04 user_data=@infect.sh automount:=false location=fsn1
@@ -87,7 +87,8 @@ steps:
   commands:
   - sleep 300
   - t0="$(date '+%s')"; until nix shell --inputs-from git+https://git.selfprivacy.org/alexoundos/selfprivacy-tests.git nixpkgs#netcat -c nc -zv -w1 "$DOMAIN" 443; do sleep 10; cur_date="$(date '+%s')"; remaining=$((t0 + TIMEOUT - cur_date)); [ "$remaining" -gt 0 ]; echo "$remaining seconds remain before teardown"; done
-  - sleep 10
+  - echo "give time for obtaining ACME certificate"
+  - sleep 60
 
 - name: basic test
   environment:
@@ -103,20 +104,21 @@ steps:
     TIMEOUT_1: 100
   commands:
   # ideally it should depend on $STAGING_ACME
-  # INSECURE=$(if [[ $STAGING_ACME == true ]]; then echo "--insecure"; else echo ""; fi)
-  - INSECURE="--insecure"
+  # CERT_VERIFY=$(if [[ $STAGING_ACME == true ]]; then echo "--cacert root.pem"; else echo ""; fi)
+  - CERT_VERIFY="--cacert root.pem"
   - source $(nix build $TESTS_REPO#library --print-out-paths)
+  - curl https://letsencrypt.org/certs/staging/letsencrypt-stg-root-x1.pem -sS --fail -o root.pem
   - dig api.$DOMAIN
   - >
-    retry $TIMEOUT_1 10 curl https://api.$DOMAIN/services/status --fail-with-body $INSECURE -H "Authorization: Bearer $USER_PASS"
+    retry $TIMEOUT_1 10 curl https://api.$DOMAIN/services/status --fail-with-body $CERT_VERIFY -H "Authorization: Bearer $USER_PASS"
   - swaks --to ci@$DOMAIN -s selfprivacy.org -tls -au test@selfprivacy.org -ap $TEST_EMAIL_PASS -ahp
   - >
-    curl https://cloud.$DOMAIN/ocs/v2.php/apps/serverinfo/api/v1/info?format=json --fail-with-body $INSECURE -u "admin:$USER_PASS" | jq -re ".ocs.meta.status == \"ok\""
-  - echo "File to test nextcloud upload" > file
+    curl https://cloud.$DOMAIN/ocs/v2.php/apps/serverinfo/api/v1/info?format=json -sS --fail-with-body $CERT_VERIFY -u "admin:$USER_PASS" | jq -re '.ocs.meta.status == "ok"'
+  - echo 'File to test nextcloud upload' > file
   - >
-    curl -X PUT https://cloud.$DOMAIN/remote.php/dav/files/admin/file --fail-with-body $INSECURE -d @file -u "admin:$USER_PASS"
+    curl -X PUT https://cloud.$DOMAIN/remote.php/dav/files/admin/file -sS --fail-with-body $CERT_VERIFY -d @file -u "admin:$USER_PASS"
   - >
-    curl https://cloud.$DOMAIN/remote.php/dav/files/admin/file --fail-with-body $INSECURE -u "admin:$USER_PASS"
+    curl https://cloud.$DOMAIN/remote.php/dav/files/admin/file -sS --fail-with-body $CERT_VERIFY -u "admin:$USER_PASS"
 
 - name: API & nixos-rebuild test
   environment: