diff --git a/scripts/homelab/cluster-issuer.yaml b/scripts/homelab/cluster-issuer.yaml
index b408aef..9ea191b 100644
--- a/scripts/homelab/cluster-issuer.yaml
+++ b/scripts/homelab/cluster-issuer.yaml
@@ -58,6 +58,41 @@
               key: api-token
               name: gandi-credentials
 ---
+# TODO(giolekva): move to ingerss-nginx-private namespace
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: selfsigned
+  namespace: cert-manager
+spec:
+  selfSigned: {}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: selfsigned-ca-root
+  namespace: cert-manager
+spec:
+  isCA: true
+  commonName: selfsigned-ca-root
+  secretName: selfsigned-ca-root
+  privateKey:
+    algorithm: ECDSA
+    size: 256
+  issuerRef:
+    name: selfsigned
+    kind: ClusterIssuer
+    group: cert-manager.io
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: selfsigned-ca
+  namespace: cert-manager
+spec:
+  ca:
+    secretName: selfsigned-ca-root
+---
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata: