diff --git a/.gitlab/tests/cram/generic/acceleration-plan-components/020-security.t b/.gitlab/tests/cram/generic/acceleration-plan-components/020-security.t
index c50965e26d..e7589fcb6b 100644
--- a/.gitlab/tests/cram/generic/acceleration-plan-components/020-security.t
+++ b/.gitlab/tests/cram/generic/acceleration-plan-components/020-security.t
@@ -9,9 +9,14 @@ Backup the state of the system:
   $ R "mv /etc/config/autocert /etc/config/autocert.bak"
   $ R "mkdir -p /usr/share/ca-certificates"
   $ R "mv /usr/share/ca-certificates /usr/share/ca-certificates.bak"
+  $ R "mkdir -p /etc/ssl/certs"
+  $ R "mv /etc/ssl/certs /etc/ssl/certs.bak"
+  $ R "mkdir -p /etc/amx/tr181-security/defaults.d"
+  $ R "mv /etc/amx/tr181-security/defaults.d /etc/amx/tr181-security/defaults.d.bak"
 
 Copy over testing certificates:
 
+  $ R "mkdir -p /etc/amx/tr181-security/defaults.d"
   $ R "mkdir -p /etc/config/autocert"
   $ C ${CI_PROJECT_DIR}/.gitlab/certs/tr181-security/autocert/* "root@${TARGET_LAN_IP}:/etc/config/autocert/"
   Warning: Permanently added '*' (*) to the list of known hosts* (glob)
@@ -40,6 +45,7 @@ Check that certificate can be disabled (PCF-1054):
   $ R "ba-cli --json 'Security.Certificate.[SignatureAlgorithm==\"ecdsa-with-SHA512\" && Enable==False].?' | sed -n '2p'" | jq --sort-keys .[0] | grep -v -E '(NotAfter|NotBefore|LastModif)'
   {
     "Security.Certificate.\d+.": { (re)
+      "Alias": "cpe-Certificate-\d+", (re)
       "Enable": 0,
       "Issuer": "/C=US/O=PrplFoundation/OU=prplOS/CN=prplOS.lan",
       "SerialNumber": "2022A6A3FDECA910242A18EFFB214776206F2ED8",
@@ -57,6 +63,7 @@ Check that certificate can be enabled (PCF-1054):
   $ R "ba-cli --json 'Security.Certificate.[SignatureAlgorithm==\"ecdsa-with-SHA512\" && Enable==True].?' | sed -n '2p'" | jq --sort-keys .[0] | grep -v -E '(NotAfter|NotBefore|LastModif)'
   {
     "Security.Certificate.\d+.": { (re)
+      "Alias": "cpe-Certificate-\d+", (re)
       "Enable": 1,
       "Issuer": "/C=US/O=PrplFoundation/OU=prplOS/CN=prplOS.lan",
       "SerialNumber": "2022A6A3FDECA910242A18EFFB214776206F2ED8",
@@ -87,13 +94,13 @@ Check that CABundle are presents:
   $ R "echo '%populate{object Security{object CABundle{instance add(){parameter Enable=1; parameter Name=cram; parameter CAFileURI=\"/tmp/server-cert.crt\";}}}}' > /etc/amx/tr181-security/defaults.d/01_cram_periodic_transfer.odl" ; sleep 1
   $ R '/etc/init.d/tr181-security restart'
   $ R 'ba-cli Security.CABundleNumberOfEntries?' | grep -v '>'
-  Security.CABundleNumberOfEntries=2
+  Security.CABundleNumberOfEntries=1
   
 
 Check CABundle RPC:
 
-  $ R "ba-cli 'Security.CABundle.2.CAFile()'" | grep -v '>'
-  Security.CABundle.2.CAFile() returned
+  $ R "ba-cli 'Security.CABundle.1.CAFile()'" | grep -v '>'
+  Security.CABundle.1.CAFile() returned
   [
       "",
       {
@@ -101,8 +108,8 @@ Check CABundle RPC:
       }
   ]
   
-  $ R "ba-cli 'Security.CABundle.2.CADir()'" | grep -v '>'
-  Security.CABundle.2.CADir() returned
+  $ R "ba-cli 'Security.CABundle.1.CADir()'" | grep -v '>'
+  Security.CABundle.1.CADir() returned
   [
       "",
       {
@@ -110,9 +117,9 @@ Check CABundle RPC:
       }
   ]
   
-  $ R "ba-cli 'Security.CABundle.2.CADirURI=/tmp'" >/dev/null
-  $ R "ba-cli 'Security.CABundle.2.CADir()'" | grep -v '>'
-  Security.CABundle.2.CADir() returned
+  $ R "ba-cli 'Security.CABundle.1.CADirURI=/tmp'" >/dev/null
+  $ R "ba-cli 'Security.CABundle.1.CADir()'" | grep -v '>'
+  Security.CABundle.1.CADir() returned
   [
       "",
       {
@@ -123,8 +130,11 @@ Check CABundle RPC:
 
 Restore the state of the system:
 
-  $ R 'rm -rf /etc/amx/tr181-security/defaults.d/01_cram_periodic_transfer.odl'
+  $ R 'rm -rf /etc/amx/tr181-security/defaults.d'
+  $ R "mv /etc/amx/tr181-security/defaults.d.bak /etc/amx/tr181-security/defaults.d"
   $ R '/etc/init.d/tr181-security restart'
+  $ R "rm -rf /etc/ssl/certs"
+  $ R "mv /etc/ssl/certs.bak /etc/ssl/certs"
   $ R "rm -rf /etc/config/autocert"
   $ R "mv /etc/config/autocert.bak /etc/config/autocert"
   $ R "rm -rf /usr/share/ca-certificates"
diff --git a/.gitlab/tests/cram/generic/acceleration-plan-components/130-periodicfileupload.t b/.gitlab/tests/cram/generic/acceleration-plan-components/130-periodicfileupload.t
index 6994276888..e6eccb3da8 100644
--- a/.gitlab/tests/cram/generic/acceleration-plan-components/130-periodicfileupload.t
+++ b/.gitlab/tests/cram/generic/acceleration-plan-components/130-periodicfileupload.t
@@ -152,10 +152,10 @@ Check PeriodicFileTransfer over HTTPS:
   $ servefile_pid="$!"
   $ sleep 2
   $ R "openssl s_client -connect \"$SERVER_IP:8181\" -showcerts < /dev/null 2> /dev/null | openssl x509 -outform PEM > /tmp/server-cert.crt"; sleep 1
-  $ R "echo '%populate{object Security{object CABundle{instance add(){parameter Enable=1; parameter CAFileURI=\"/tmp/server-cert.crt\";}}}}' > /etc/amx/tr181-security/defaults.d/01_cram_periodic_transfer.odl" ; sleep 1
+  $ R "echo '%populate{object Security{object CABundle{instance add("cram"){parameter Enable=1; parameter Name=cram; parameter CAFileURI=\"/tmp/server-cert.crt\";}}}}' > /etc/amx/tr181-security/defaults.d/01_cram_periodic_transfer.odl" ; sleep 1
   $ R '/etc/init.d/tr181-security restart'; sleep 1
   $ R 'ba-cli "Device.PeriodicFileTransfer.Profile.cram-Profile-1.Protocol=HTTPS"' > /dev/null; sleep 1
-  $ R 'ba-cli "Device.PeriodicFileTransfer.Profile.cram-Profile-1.HTTP.CABundle=Device.Security.CABundle.2"' > /dev/null; sleep 1
+  $ R 'ba-cli "Device.PeriodicFileTransfer.Profile.cram-Profile-1.HTTP.CABundle=Device.Security.CABundle.cram"' > /dev/null; sleep 1
   $ R "ba-cli 'Device.PeriodicFileTransfer.Profile.cram-Profile-1.HTTP.URL=\"https://$SERVER_IP:8181\"'" > /dev/null; sleep 1
   $ R 'ba-cli "Device.PeriodicFileTransfer.Transfer.cram-Transfer-1.ForceTransfer()"' | grep -v '>' ; sleep 1
   Device.PeriodicFileTransfer.Transfer.cram-Transfer-1.ForceTransfer() returned
diff --git a/.gitlab/tests/cram/generic/softhsm/001-hsm-setup.t b/.gitlab/tests/cram/generic/softhsm/001-hsm-setup.t
index 4c77843eb6..7cdb55d125 100644
--- a/.gitlab/tests/cram/generic/softhsm/001-hsm-setup.t
+++ b/.gitlab/tests/cram/generic/softhsm/001-hsm-setup.t
@@ -20,7 +20,7 @@ Test the creation of a certificate using PKCS11 URIs:
 
   $ R "openssl req -new -engine pkcs11 -keyform ENGINE -key 'pkcs11:object=cpe-key;type=private' -out /tmp/cpe.csr -subj '/CN=prplOS.lan' &> /dev/null"
   $ R "ls /tmp/cpe.csr &> /dev/null"
-  $ R "openssl x509 -req -in /tmp/cpe.csr -CA /usr/share/ca-certificates/ca.crt -engine pkcs11 -CAkeyform ENGINE -CAkey 'pkcs11:object=ca-key;type=private' -CAcreateserial -out /tmp/cpe.crt -days 3650 -sha256 &> /dev/null"
+  $ R "openssl x509 -req -in /tmp/cpe.csr -CA /usr/share/ca-certificates/test/ca.crt -engine pkcs11 -CAkeyform ENGINE -CAkey 'pkcs11:object=ca-key;type=private' -CAcreateserial -out /tmp/cpe.crt -days 3650 -sha256 &> /dev/null"
   $ R "ls /tmp/cpe.crt &> /dev/null"
 
 Create client key/cert needed for tests:
@@ -28,7 +28,7 @@ Create client key/cert needed for tests:
   $ R "openssl genrsa -out /root/certs/client.key 2048"
   $ R "pkcs11-tool --module /usr/lib/softhsm/libsofthsm2.so --login --pin 1234 --write-object /root/certs/client.key --type privkey --label 'client-key' &> /dev/null"
   $ R "openssl req -new -engine pkcs11 -keyform ENGINE -key 'pkcs11:object=client-key;type=private' -out /root/certs/client.csr -subj '/CN=cpe.local' &> /dev/null"
-  $ R "openssl x509 -req -in /root/certs/client.csr -CA /usr/share/ca-certificates/ca.crt -engine pkcs11 -CAkeyform ENGINE -CAkey 'pkcs11:object=ca-key;type=private' -CAcreateserial -out /root/certs/client.crt -days 3650 -sha256 &> /dev/null"
+  $ R "openssl x509 -req -in /root/certs/client.csr -CA /usr/share/ca-certificates/test/ca.crt -engine pkcs11 -CAkeyform ENGINE -CAkey 'pkcs11:object=ca-key;type=private' -CAcreateserial -out /root/certs/client.crt -days 3650 -sha256 &> /dev/null"
 
 Allow HSM secure storage access for users in the certificates group:
 
diff --git a/.gitlab/tests/cram/generic/softhsm/002-hsm-mqtt-broker.t b/.gitlab/tests/cram/generic/softhsm/002-hsm-mqtt-broker.t
index 1b44928f98..c89e728661 100644
--- a/.gitlab/tests/cram/generic/softhsm/002-hsm-mqtt-broker.t
+++ b/.gitlab/tests/cram/generic/softhsm/002-hsm-mqtt-broker.t
@@ -11,7 +11,8 @@ Setup mqttbroker for pkcs11:
   > ba-cli MQTTBroker.Broker.secure.TlsEngine=true
   > ba-cli MQTTBroker.Broker.secure.TlsEngineId="pkcs11"
   > ba-cli MQTTBroker.Broker.secure.CertFile=""
-  > ba-cli MQTTBroker.Broker.secure.CAFile="/usr/share/ca-certificates/ca.crt"
+  > ba-cli MQTTBroker.Broker.secure.CAFile=""
+  > ba-cli MQTTBroker.Broker.secure.CABundle="Device.Security.CABundle.test."
   > ba-cli MQTTBroker.Broker.secure.Ciphers="DEFAULT"
   > ba-cli MQTTBroker.Broker.secure.RequireCertificate=true
   > ba-cli MQTTBroker.Broker.secure.KeyFile=""
@@ -26,4 +27,4 @@ Check mqtt publish at port 8883:
   $ S="mqtt-publish-sec.sh"
   $ C "${TESTDIR}/${S}" "root@${TARGET_LAN_IP}:/tmp/"
   Warning: Permanently added '*' (*) to the list of known hosts* (glob)
-  $ R "source /tmp/${S} | grep -q 'sending PUBLISH'"
\ No newline at end of file
+  $ R "source /tmp/${S} | grep -q 'sending PUBLISH'"
diff --git a/.gitlab/tests/cram/generic/softhsm/003-hsm-http-server.t b/.gitlab/tests/cram/generic/softhsm/003-hsm-http-server.t
index 9ed43bd03e..45ad0c8778 100644
--- a/.gitlab/tests/cram/generic/softhsm/003-hsm-http-server.t
+++ b/.gitlab/tests/cram/generic/softhsm/003-hsm-http-server.t
@@ -18,5 +18,5 @@ Setup https server at prplOS.lan/localhost 127.0.0.1:
 
 Check server response ok:
 
-  $ R "curl --cacert /usr/share/ca-certificates/ca.crt --silent --output /dev/null --write-out \"%{http_code}\\n\" https://prplOS.lan"
-  200
\ No newline at end of file
+  $ R "curl --cacert /usr/share/ca-certificates/test/ca.crt --silent --output /dev/null --write-out \"%{http_code}\\n\" https://prplOS.lan"
+  200
diff --git a/.gitlab/tests/cram/generic/softhsm/004-hsm-mqtt-client.t b/.gitlab/tests/cram/generic/softhsm/004-hsm-mqtt-client.t
index d866b18e82..ac6d76a8ed 100644
--- a/.gitlab/tests/cram/generic/softhsm/004-hsm-mqtt-client.t
+++ b/.gitlab/tests/cram/generic/softhsm/004-hsm-mqtt-client.t
@@ -15,7 +15,8 @@ Setup https server at prplOS.lan/localhost 127.0.0.1:
   > ba-cli MQTT.Client.1.BrokerAddress="127.0.0.1"
   > ba-cli MQTT.Client.1.BrokerPort=8883
   > ba-cli MQTT.Client.1.CheckServerHostName=false
-  > ba-cli MQTT.Client.1.CACertificate="/usr/share/ca-certificates/ca.crt"
+  > ba-cli MQTT.Client.1.CACertificate=""
+  > ba-cli MQTT.Client.1.CABundle="Device.Security.CABundle.test."
   > ba-cli MQTT.Client.1.ClientCertificate=""
   > ba-cli MQTT.Client.1.PrivateKey=""
   > ba-cli MQTT.Client.1.Certificate="Device.Security.Certificate.2."
@@ -35,4 +36,4 @@ Setup https server at prplOS.lan/localhost 127.0.0.1:
 
   $ R "ba-cli 'BulkData.Enable=0' > /dev/null"
   $ R "ba-cli 'MQTT.Client.1.Enable=0' > /dev/null"
-  $ sleep 1
\ No newline at end of file
+  $ sleep 1
diff --git a/.gitlab/tests/cram/generic/softhsm/mqtt-publish-sec.sh b/.gitlab/tests/cram/generic/softhsm/mqtt-publish-sec.sh
index 30761b5e6c..2c49816665 100644
--- a/.gitlab/tests/cram/generic/softhsm/mqtt-publish-sec.sh
+++ b/.gitlab/tests/cram/generic/softhsm/mqtt-publish-sec.sh
@@ -1,6 +1,6 @@
 export PKCS11_MODULE_PATH=/usr/lib/softhsm/libsofthsm2.so
 mosquitto_pub \
-  --cafile /usr/share/ca-certificates/ca.crt \
+  --cafile /usr/share/ca-certificates/test/ca.crt \
   --cert /root/certs/client.crt \
   --key /root/certs/client.key \
   -h prplOS.lan -p 8883 \