diff --git a/attributes/default.rb b/attributes/default.rb
index e826932..eabea9e 100644
--- a/attributes/default.rb
+++ b/attributes/default.rb
@@ -87,6 +87,8 @@ default['postfix']['main']['inet_interfaces'] = 'loopback-only'
 
 # Conditional attributes, also reference _attributes recipe
 case node['platform_family']
+when 'debian'
+  default['postfix']['cafile'] = '/etc/ssl/certs/ca-certificates.crt'
 when 'smartos'
   default['postfix']['main']['smtpd_use_tls'] = 'no'
   default['postfix']['main']['smtp_use_tls'] = 'no'
diff --git a/spec/default_spec.rb b/spec/default_spec.rb
index 790c563..ac6cb35 100644
--- a/spec/default_spec.rb
+++ b/spec/default_spec.rb
@@ -39,7 +39,7 @@ describe 'postfix::default' do
     end
 
     it '[COOK-4423] renders file main.cf with /etc/postfix/cacert.pem' do
-      expect(chef_run).to render_file('/etc/postfix/main.cf').with_content(%r{smtp_tls_CAfile += +/etc/postfix/cacert.pem})
+      expect(chef_run).to render_file('/etc/postfix/main.cf').with_content(%r{smtp_tls_CAfile += +/etc/ssl/certs/ca-certificates.crt})
     end
 
     it '[COOK-4619] does not set recipient_delimiter' do