diff --git a/argocd-nginx/base/argocd-certificate.yaml b/argocd-nginx/base/argocd-certificate.yaml
new file mode 100644
index 0000000..da46f33
--- /dev/null
+++ b/argocd-nginx/base/argocd-certificate.yaml
@@ -0,0 +1,22 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: tls-secret
+  namespace: argocd
+spec:
+  # Secret names are always required.
+  secretName: tls-secret
+
+  duration: 2160h # 90d
+  renewBefore: 360h # 15d
+
+  # At least one of commonName (possibly through literalSubject), dnsNames, uris, emailAddresses, ipAddresses or otherNames is required.
+  dnsNames:
+    - argocd-test.streams.sunet.se
+
+  # Issuer references are always required.
+  issuerRef:
+    name: ca-issuer
+    # We can reference ClusterIssuers by changing the kind here.
+    # The default value is Issuer (i.e. a locally namespaced Issuer)
+    kind: ClusterIssuer
diff --git a/argocd-nginx/base/kustomization.yaml b/argocd-nginx/base/kustomization.yaml
index 6802995..55767f8 100644
--- a/argocd-nginx/base/kustomization.yaml
+++ b/argocd-nginx/base/kustomization.yaml
@@ -1,2 +1,3 @@
 resources:
   - argocd-ingress.yaml
+  - argocd-certificate.yaml