diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9b983c5c140..0834e2d4362 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,7 @@ The following sections list the changes for unreleased.
 
 ## Summary
 
+* Bugfix - Idp: Check if CA certificate if present: [#3623](https://github.com/owncloud/ocis/issues/3623)
 * Bugfix - Return proper errors when ocs/cloud/users is using the cs3 backend: [#3483](https://github.com/owncloud/ocis/issues/3483)
 * Bugfix - URL encode the webdav url in the graph API: [#3597](https://github.com/owncloud/ocis/pull/3597)
 * Change - Load configuration files just from one directory: [#3587](https://github.com/owncloud/ocis/pull/3587)
@@ -15,6 +16,14 @@ The following sections list the changes for unreleased.
 
 ## Details
 
+* Bugfix - Idp: Check if CA certificate if present: [#3623](https://github.com/owncloud/ocis/issues/3623)
+
+   Upon first start with the default configurtation the idm service creates a server
+   certificate, that might not be finished before the idp service is starting. Add a check to idp
+   similar to what the user, group, and auth-providers implement.
+
+   https://github.com/owncloud/ocis/issues/3623
+
 * Bugfix - Return proper errors when ocs/cloud/users is using the cs3 backend: [#3483](https://github.com/owncloud/ocis/issues/3483)
 
    The ocs API was just exiting with a fatal error on any update request, when configured for the cs3