diff --git a/readme.md b/readme.md
index 1b93a7f..7c38b7f 100644
--- a/readme.md
+++ b/readme.md
@@ -236,14 +236,14 @@ Handle project workflows in a unified way:
     * pacman
     * zypper
   * repositories
-    * codecs
-      * epel
-      * fedora
-      * opensuse
     * opensuse
+      * codecs repository
       * disable & enable https
 * persist locales
 * test
+* variables
+  * CA_n
+  * DNS_n
 
 #### Shell → Python
 
diff --git a/spcd/bootstrap.sh b/spcd/bootstrap.sh
index 8a99eff..1d0592e 100644
--- a/spcd/bootstrap.sh
+++ b/spcd/bootstrap.sh
@@ -199,65 +199,6 @@ _spcd_txt_pick() {
 # │ functions │
 # ╰───────────╯
 
-spcd_ca() {
-    local index name value
-    local grep="\(After\|Before\|Issuer\|Signature Algorithm\|Subject:\)"
-    case "${1}" in
-    "list")
-        while true; do
-            index=$((index + 1))
-            name="SPCD_CA_${index}"
-            eval "value=\"\${name}\""
-            [ -n "${value}" ] || break
-            echo "${name} ="
-            echo "${value}" |
-                openssl x509 -noout -text |
-                grep "${grep}"
-        done
-        ;;
-    "write")
-        local root="${2}"
-        while true; do
-            index=$((index + 1))
-            name="SPCD_CA_${index}"
-            eval "value=\"\${name}\""
-            [ -n "${value}" ] || break
-            spcd_os_write "${root}/${index}.crt" "${value}"
-        done
-        ;;
-    *) ;;
-    esac
-}
-
-spcd_dns() {
-    local index name value
-    case "${1}" in
-    "list")
-        while true; do
-            index=$((index + 1))
-            name="SPCD_DNS_${index}"
-            eval "value=\"\${name}\""
-            [ -n "${value}" ] || break
-            spcd_os_printenv "${name}"
-        done
-        ;;
-    "write")
-        local text
-        while true; do
-            index=$((index + 1))
-            name="SPCD_DNS_${index}"
-            eval "value=\"\${name}\""
-            [ -n "${value}" ] || break
-            text="${text}\
-nameserver ${value}
-"
-        done
-        spcd_os_write "/etc/resolv.conf" "${text}"
-        ;;
-    *) ;;
-    esac
-}
-
 # ╭───────────┬───────╮
 # │ functions │ error │
 # ╰───────────┴───────╯
@@ -273,6 +214,19 @@ spcd_error_os() {
     exit "${_SPCD_ERROR_OS}"
 }
 
+# ╭───────────┬─────────╮
+# │ functions │ openssl │
+# ╰───────────┴─────────╯
+
+spcd_openssl_x509() {
+    if [ -f "${1}" ]; then
+        openssl x509 \
+            -in "${1}" \
+            -noout -text |
+            grep "\(After\|Before\|Issuer\|Signature A\|Subject:\)"
+    fi
+}
+
 # ╭───────────┬────╮
 # │ functions │ os │
 # ╰───────────┴────╯
@@ -480,9 +434,9 @@ SPCD_PM_ZYPPER="zypper"
 # ╰──────┴─────────────╯
 
 spcd_step__environment_defaults_print() {
-    spcd_ca "list"
-    spcd_dns "list"
     set -- \
+        \
+        \
         "GIT_RWX" \
         "GIT_SPCD" \
         "GIT_SHUNIT" \
@@ -942,7 +896,16 @@ spcd_query_package() {
 
 spcd_step__dns() {
     spcd_step "DNS"
-    spcd_dns "write"
+    local index value text
+    while true; do
+        index=$((index + 1))
+        eval "value=\"\${SPCD_DNS_${index}}\""
+        [ -n "${value}" ] || break
+        text="${text}\
+nameserver ${value}
+"
+    done
+    spcd_os_write "/etc/resolv.conf" "${text}"
 }
 
 # ╭──────┬──────────╮
@@ -1189,7 +1152,7 @@ spcd_step__ca_install_package() {
 
 spcd_step__ca_write_certificates() {
     spcd_step "Write certificates"
-    local root
+    local root index text path
     case "${SPCD_OS_ID}" in
     "${SPCD_OS_ALMA}" | "${SPCD_OS_FEDORA}" | "${SPCD_OS_ROCKY}")
         root="/etc/pki/ca-trust/source/anchors"
@@ -1206,7 +1169,15 @@ spcd_step__ca_write_certificates() {
     *) ;;
     esac
     spcd_os_mkdir "${root}"
-    spcd_ca "write" "${root}"
+    while true; do
+        index=$((index + 1))
+        eval "text=\"\${SPCD_CA_${index}}\""
+        [ -n "${text}" ] || break
+        path="${root}/${index}.crt"
+        spcd_split
+        spcd_os_write "${path}" "${text}"
+        spcd_openssl_x509 "${path}"
+    done
 }
 
 spcd_step__ca_update_certificates() {