diff --git a/tsm-client/tasks/main.yml b/tsm-client/tasks/main.yml
index c3f9ff33e46497e4577d5528e9c04e780ae7434b..48afba9b72cb07b8388c5092f497f94de091bb61 100644
--- a/tsm-client/tasks/main.yml
+++ b/tsm-client/tasks/main.yml
@@ -48,3 +48,10 @@
     - tsm
     - config
 
+- name: ensure tls anchor certificate is configured
+  command: dsmcert -add -server "T-TeleSec GlobalRoot Class 2" -file /etc/ssl/certs/T-TeleSec_GlobalRoot_Class_2.pem
+  args:
+    creates: IBM/SpectrumProtect/certs/dsmcert.sth
+  tags:
+    - tsm
+    - config