diff --git a/k8s/core/cert-manager/self-signed.yaml b/k8s/core/cert-manager/self-signed.yaml
new file mode 100644
index 0000000..a7c0d39
--- /dev/null
+++ b/k8s/core/cert-manager/self-signed.yaml
@@ -0,0 +1,29 @@
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: selfsigned
+spec:
+  selfSigned: {}
+
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: hexor-ca-root
+spec:
+  isCA: true
+  commonName: hexor-ca
+  secretName: hexor-ca-root-secret
+  issuerRef:
+    name: selfsigned
+    kind: ClusterIssuer
+
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: hexor-lab
+spec:
+  ca:
+    secretName: hexor-ca-root-secret