diff --git a/roles/collabora/tasks/apache.yml b/roles/collabora/tasks/apache.yml
index e07c3ae..8f932da 100644
--- a/roles/collabora/tasks/apache.yml
+++ b/roles/collabora/tasks/apache.yml
@@ -6,6 +6,8 @@
     owner: root
     group: root
     mode: 0644
+    force: no
+  register: collabora_http
 - name: disable default site and enable collabora site
   block:
     - name: disable default site
@@ -19,7 +21,7 @@
 - name: run certbot
   command:
     cmd: certbot --apache --non-interactive --keep-until-expiring --no-eff-email --email {{ admin_mail }} --redirect --renew-with-new-domains --agree-tos -d {{ collabora_domain }}
-  when: ansible_domain != 'dev'
+  when: ansible_domain != 'dev' and collabora_http.changed
 - include: ssl-dev.yml
   when: ansible_domain == 'dev'
 - name: add collabora https site
diff --git a/roles/drone/tasks/apache.yml b/roles/drone/tasks/apache.yml
index d985105..d0b32cb 100644
--- a/roles/drone/tasks/apache.yml
+++ b/roles/drone/tasks/apache.yml
@@ -6,6 +6,8 @@
     owner: root
     group: root
     mode: 0644
+    force: no
+  register: drone_http
 - name: disable default site and enable drone site
   block:
     - name: disable default site
@@ -19,7 +21,7 @@
 - name: run certbot
   command:
     cmd: certbot --apache --non-interactive --keep-until-expiring --no-eff-email --email {{ admin_mail }} --redirect --renew-with-new-domains --agree-tos -d {{ ci_domain }}
-  when: ansible_domain != 'dev'
+  when: ansible_domain != 'dev' and drone_http.changed
 - include: ssl-dev.yml
   when: ansible_domain == 'dev'
 - name: add drone https site