diff --git a/charts/certificate-issuer/templates/root-ca-server.yaml b/charts/certificate-issuer/templates/root-ca-server.yaml
new file mode 100644
index 0000000..06f38d8
--- /dev/null
+++ b/charts/certificate-issuer/templates/root-ca-server.yaml
@@ -0,0 +1,85 @@
+# TODO(giolekva): move to ingerss-nginx-private namespace
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Values.private.name }}-root-ca
+  namespace: {{ .Release.Namespace }}
+spec:
+  selector:
+    matchLabels:
+      app: {{ .Values.private.name }}-root-ca
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: {{ .Values.private.name }}-root-ca
+    spec:
+      volumes:
+      - name: root-ca-secret
+        secret:
+          secretName: {{ .Values.private.name }}-ca-root
+          items:
+          - key: ca.crt
+            path: private-root-ca.crt
+      containers:
+      - name: file-server
+        image: giolekva/static-file-server:latest
+        imagePullPolicy: Always
+        ports:
+        - name: http
+          containerPort: 80
+        command: ["static-file-server"]
+        args: ["-port=80", "-dir=/etc/static-file-server/data"]
+        volumeMounts:
+        - name: root-ca-secret
+          mountPath: /etc/static-file-server/data/
+          readOnly: true
+        resources:
+          requests:
+            memory: "10Mi"
+            cpu: "10m"
+          limits:
+            memory: "20Mi"
+            cpu: "100m"
+      tolerations:
+      - key: "pcloud"
+        operator: "Equal"
+        value: "role"
+        effect: "NoSchedule"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Values.private.name }}-root-ca
+  namespace: {{ .Release.Namespace }}
+spec:
+  type: ClusterIP
+  selector:
+    app: {{ .Values.private.name }}-root-ca
+  ports:
+    - name: http
+      port: 80
+      targetPort: http
+      protocol: TCP
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ .Values.private.name }}-root-ca
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+spec:
+  ingressClassName: {{ .Values.private.ingressClassName }}
+  rules:
+  - host: root-ca.{{ .Values.private.domain }}
+    http:
+      paths:
+      - pathType: Prefix
+        path: "/"
+        backend:
+          service:
+            name: {{ .Values.private.name }}-root-ca
+            port:
+              name: http
diff --git a/charts/certificate-issuer/values.yaml b/charts/certificate-issuer/values.yaml
index 4f40083..57a0d43 100644
--- a/charts/certificate-issuer/values.yaml
+++ b/charts/certificate-issuer/values.yaml
@@ -5,4 +5,5 @@
   ingressClass: ingress-nginx
 private:
   name: selfsigned-private
+  domain: pcloud