diff --git a/roles/debian/aws_efs_client/tasks/main.yml b/roles/debian/aws_efs_client/tasks/main.yml
index 3178f2f33..c853e59d5 100644
--- a/roles/debian/aws_efs_client/tasks/main.yml
+++ b/roles/debian/aws_efs_client/tasks/main.yml
@@ -9,6 +9,7 @@
 - name: Install AWS EFS utils packaged by Code Enigma.
   ansible.builtin.apt:
     deb: "https://github.com/codeenigma/aws-efs-utils-deb-builder/releases/download/v{{ aws_efs_client.version }}/amazon-efs-utils-{{ aws_efs_client.version }}{{ aws_efs_client.build_suffix }}.deb"
+    force: true
   when:
     - aws_efs_client.deb_url | length == 0
 
diff --git a/roles/debian/pam_ldap/templates/ldap.conf.j2 b/roles/debian/pam_ldap/templates/ldap.conf.j2
index c3e7d3b35..1139a56d0 100644
--- a/roles/debian/pam_ldap/templates/ldap.conf.j2
+++ b/roles/debian/pam_ldap/templates/ldap.conf.j2
@@ -1,9 +1,7 @@
 BASE {{ pam_ldap.lookup_base }}
-URI {{ pam_ldap.endpoints | join(' ') }}
-{% if pam_ldap.ssl_use_system_ca %}
+URI	{{ pam_ldap.endpoints | join(' ') }}
+{% if pam_ldap.ssl_certificate is defined and pam_ldap.ssl_certificate %}
 TLS_CACERT /etc/ssl/certs/ca-certificates.crt
-{% elif pam_ldap.ssl_certificate %}
-TLS_CACERT /etc/ldap/ssl/{{ pam_ldap.ssl_certificate | basename }}
 {% endif %}
 BIND_TIMELIMIT 5
 TIMEOUT 5