diff --git a/client/build.sh b/client/build.sh
index 0cda2a6..9f32547 100755
--- a/client/build.sh
+++ b/client/build.sh
@@ -24,8 +24,8 @@ LAST_EMCC_VER="$(cat "$BUILD_DIR/emcc_version.txt" || emcc --version)"
 if [ ! "$CURRENT_EMCC_VER" = "$LAST_EMCC_VER" ]; then
   echo "triggering a full rebuild since we're on a different emcc version"
   rm -rf "$BUILD_DIR"
-  mkdir -p "$BUILD_DIR"
 fi
+mkdir -p "$BUILD_DIR"
 emcc --version > "$BUILD_DIR/emcc_version.txt"
 
 #read exported functions
diff --git a/client/tools/generate_cert.sh b/client/tools/generate_cert.sh
index 84c9aad..cf340c0 100755
--- a/client/tools/generate_cert.sh
+++ b/client/tools/generate_cert.sh
@@ -12,7 +12,16 @@ CACERT_DIR="$(dirname $CACERT_FILE)"
 REPLACE_STR="$(echo $CACERT_DIR | tr '/-' '_')"
 
 if [ ! -f $CACERT_FILE ]; then
-  wget "https://curl.se/ca/cacert.pem" -O $CACERT_FILE
+  wget "https://curl.se/ca/cacert.pem" -O "$CACERT_FILE"
+  #without this cert open.spotify.com does not work
+  #https://github.com/wolfSSL/wolfssl/issues/8137
+  new_cert="$(curl "https://www.certainly.com/certificates/Certainly_Intermediate_R1.pem")"
+  insert_before="Certainly Root E1"
+  replacement="$(printf "\n$new_cert\n\n$insert_before")"
+
+  cacert_str="$(cat "$CACERT_FILE")"
+  cacert_str="${cacert_str/"$insert_before"/"$replacement"}"
+  echo "$cacert_str" > $CACERT_FILE
 fi
 xxd -i $CACERT_FILE > $CACERT_HEADER
 sed -i "s/$REPLACE_STR//" $CACERT_HEADER
\ No newline at end of file