diff --git a/Dockerfile b/Dockerfile
index d732c1daf..9c4608589 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,8 +1,11 @@
-FROM alpine:latest
+FROM debian:stable-slim
 
-# Only need ca-certificates & openssl if want to use DNS over TLS (RFC 7858).
-RUN apk --no-cache add bind-tools ca-certificates openssl && update-ca-certificates
+RUN apt-get update && apt-get -uy upgrade
+RUN apt-get -y install ca-certificates && update-ca-certificates
 
+FROM scratch
+
+COPY --from=0 /etc/ssl/certs /etc/ssl/certs
 ADD coredns /coredns
 
 EXPOSE 53 53/udp