ansible/roles/certificates/handlers/main.yml

---
- name: Extract root certificate
  command: /usr/bin/update-ca-trust extract
  changed_when: true  # this handler is executed just when there is a new cert
  notify: Restart Docker