diff --git a/cert-manager/certificates.yaml b/cert-manager/certificates.yaml
new file mode 100644
index 0000000..188f239
--- /dev/null
+++ b/cert-manager/certificates.yaml
@@ -0,0 +1,18 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: pyrocufflink-cert
+spec:
+  secretName: pyrocufflink-cert
+  dnsNames:
+  - '*.pyrocufflink.blue'
+  - '*.pyrocufflink.net'
+  - pyrocufflink.blue
+  - pyrocufflink.net
+  issuerRef:
+    group: cert-manager.io
+    kind: ClusterIssuer
+    name: zerossl
+  privateKey:
+    algorithm: ECDSA
+    rotationPolicy: Always
diff --git a/cert-manager/kustomization.yaml b/cert-manager/kustomization.yaml
index 575106d..7b1695d 100644
--- a/cert-manager/kustomization.yaml
+++ b/cert-manager/kustomization.yaml
@@ -4,6 +4,7 @@ kind: Kustomization
 resources:
 - cert-manager.yaml
 - cluster-issuer.yaml
+- certificates.yaml
 
 secretGenerator:
 - name: cert-manager-tsig