diff --git a/roles/cert/tasks/main.yml b/roles/cert/tasks/main.yml
new file mode 100644
index 0000000..36d0ae8
--- /dev/null
+++ b/roles/cert/tasks/main.yml
@@ -0,0 +1,12 @@
+- name: ensure server certificate is installed
+  copy:
+    src: certs/{{ cert_src }}
+    dest: '{{ cert_dest }}'
+    mode: '{{ cert_mode|d("0644") }}'
+- name: ensure server private key is installed
+  copy:
+    src: certs/{{ cert_key_src }}
+    dest: '{{ cert_key_dest }}'
+    mode: '{{ cert_key_mode|d("0600") }}'
+  diff: false
+  when: cert_key_src is defined