diff --git a/lib/containers/container_images.pm b/lib/containers/container_images.pm
index 7039c293c3bf..9e0ee95adcf1 100644
--- a/lib/containers/container_images.pm
+++ b/lib/containers/container_images.pm
@@ -182,6 +182,8 @@ sub test_opensuse_based_image {
         } else {
             record_info "non-SLE host", "This host ($host_id) does not support zypper service";
         }
+    } elsif ($image_id =~ /^(sl|sle)-micro$/) {
+        validate_script_output qq{$runtime container run --entrypoint '/bin/bash' --rm $image -c 'cat /etc/os-release'}, sub { /PRETTY_NAME="SUSE Linux Micro .*"/ };
     } else {
         $version =~ s/^Jump://i;
         validate_script_output qq{$runtime container run --entrypoint '/bin/bash' --rm $image -c 'cat /etc/os-release'}, sub { /PRETTY_NAME="openSUSE (Leap )?${version}.*"/ };
diff --git a/lib/utils.pm b/lib/utils.pm
index 0d365c752beb..ce98f7abb703 100644
--- a/lib/utils.pm
+++ b/lib/utils.pm
@@ -588,7 +588,8 @@ sub zypper_call {
     my $timeout = $args{timeout} || 700;
     my $log = $args{log};
     my $dumb_term = $args{dumb_term} // is_serial_terminal;
-
+    # (retry >=0 or ='': unchanged; if undef: 5) would first term be '' or 0: 1
+    my $retry = ($args{retry} // 5) or 1;
     my $printer = $log ? "| tee /tmp/$log" : $dumb_term ? '| cat' : '';
     die 'Exit code is from PIPESTATUS[0], not grep' if $command =~ /^((?!`).)*\| ?grep/;
 
@@ -600,7 +601,7 @@ sub zypper_call {
                     $0; if ($0 ~ /statistics/ ){ print "EOL"; group++ }; }\'\
                     /var/log/zypper.log
                     ';
-    for (1 .. 5) {
+    for (1 .. $retry) {
         $ret = script_run("zypper -n $command $printer; ( exit \${PIPESTATUS[0]} )", $timeout);
         die "zypper did not finish in $timeout seconds" unless defined($ret);
         if ($ret == 4) {
@@ -2371,16 +2372,30 @@ This functions checks if ca-certificates-suse is installed and if it is not it a
 
 sub ensure_ca_certificates_suse_installed {
     return unless is_sle || is_sle_micro;
+    my $ret = 0;
     if (script_run('rpm -qi ca-certificates-suse') == 1) {
         my $host_version = get_var("HOST_VERSION") ? 'HOST_VERSION' : 'VERSION';
         my $distversion = get_required_var($host_version) =~ s/-SP/_SP/r;    # 15 -> 15, 15-SP1 -> 15_SP1
-        zypper_call("ar --refresh http://download.suse.de/ibs/SUSE:/CA/SLE_$distversion/SUSE:CA.repo");
-        if (is_sle_micro) {
-            transactional::trup_call('--continue pkg install ca-certificates-suse');
+
+        # exit codes defined will not stop on error.
+        my $out = zypper_call("ar --refresh http://download.suse.de/ibs/SUSE:/CA/SLE_$distversion/SUSE:CA.repo", retry => 3, exitcode => [0, 1, 2, 3, 4]);
+        if ($out == 0) {
+            if (is_sle_micro) {
+                transactional::trup_call('--continue pkg install ca-certificates-suse');
+            } else {
+                zypper_call("in ca-certificates-suse");
+            }
         } else {
-            zypper_call("in ca-certificates-suse");
+            # Get SUSE SSL certificates from internal CA
+            script_retry('curl -k https://ca.suse.de/certificates/ca/SUSE_Trust_Root.crt -o /etc/pki/trust/anchors/SUSE_Trust_Root.crt', timeout => 100, delay => 30, retry => 5);
+            if (is_sle_micro) {
+                transactional::trup_call('--continue run update-ca-certificates -v');
+            } else {
+                assert_script_run 'update-ca-certificates -v';
+            }
         }
     }
+    return;
 }
 
 # non empty */sys/firmware/efi/* must exist in UEFI mode
diff --git a/tests/containers/image.pm b/tests/containers/image.pm
index 5d1331e466df..b51485c9e1d7 100644
--- a/tests/containers/image.pm
+++ b/tests/containers/image.pm
@@ -81,7 +81,7 @@ sub run {
     # We may test either one specific image VERSION or comma-separated CONTAINER_IMAGE_VERSIONS
     my $versions = get_var('CONTAINER_IMAGE_VERSIONS', get_required_var('VERSION'));
     for my $version (split(/,/, $versions)) {
-        my $image = get_image_uri(version => $version);
+        my $image = get_image_uri(version => $version, distri => ($version =~ /-SP/ ? 'sle' : undef()));
 
         if (get_var('IMAGE_STORE_DATA')) {
             # If wanted, push image information to the DB
diff --git a/tests/microos/toolbox.pm b/tests/microos/toolbox.pm
index 9312f2a04cf6..afaadc268220 100644
--- a/tests/microos/toolbox.pm
+++ b/tests/microos/toolbox.pm
@@ -60,7 +60,7 @@ sub run {
     select_console 'root-console';
     $self->create_user;
 
-    my $toolbox_image_to_test = get_var('CONTAINER_IMAGE_TO_TEST');
+    my $toolbox_image_to_test = get_var('CONTAINER_IMAGE_TO_TEST_EXTRA');
 
     if ($toolbox_image_to_test) {
         # We need to extract the registry from the full image uri, e.g.