diff --git a/terraform/bootstrap-certificates.tf b/terraform/bootstrap-certificates.tf
new file mode 100644
index 0000000..f6cbaa0
--- /dev/null
+++ b/terraform/bootstrap-certificates.tf
@@ -0,0 +1,104 @@
+resource "kubernetes_manifest" "selfsigned_bootstrap" {
+  manifest = {
+    apiVersion = "cert-manager.io/v1"
+    kind       = "ClusterIssuer"
+    metadata = {
+      name = "selfsigned-bootstrap"
+    }
+    spec = {
+      selfSigned = {}
+    }
+  }
+
+  field_manager {
+    name = "terraform"
+  }
+}
+
+resource "kubernetes_manifest" "homelab_ca_cert" {
+  manifest = {
+    apiVersion = "cert-manager.io/v1"
+    kind       = "Certificate"
+    metadata = {
+      name      = "homelab-ca"
+      namespace = kubernetes_namespace.namespaces["cert-manager"].metadata[0].name
+    }
+    spec = {
+      secretName = "homelab-ca-secret"
+      commonName = "homelab-ca"
+      isCA       = true
+      issuerRef = {
+        name = "selfsigned-bootstrap"
+        kind = "ClusterIssuer"
+      }
+      duration    = "87600h"
+      renewBefore = "720h"
+      privateKey = {
+        algorithm = "ECDSA"
+        size      = 256
+      }
+    }
+  }
+
+  field_manager {
+    name = "terraform"
+  }
+
+  depends_on = [
+    kubernetes_manifest.selfsigned_bootstrap
+  ]
+}
+
+resource "kubernetes_manifest" "homelab_ca_issuer" {
+  manifest = {
+    apiVersion = "cert-manager.io/v1"
+    kind       = "ClusterIssuer"
+    metadata = {
+      name = "homelab-ca"
+    }
+    spec = {
+      ca = {
+        secretName = "homelab-ca-secret"
+      }
+    }
+  }
+
+  field_manager {
+    name = "terraform"
+  }
+
+  depends_on = [
+    kubernetes_manifest.homelab_ca_cert
+  ]
+}
+
+resource "kubernetes_manifest" "wildcard_cert" {
+  manifest = {
+    apiVersion = "cert-manager.io/v1"
+    kind       = "Certificate"
+    metadata = {
+      name      = "homelab-tls"
+      namespace = kubernetes_namespace.namespaces["ingress-nginx"].metadata[0].name
+    }
+    spec = {
+      secretName = "homelab-tls"
+      commonName = "*.${var.cluster_domain}"
+      dnsNames   = ["*.${var.cluster_domain}"]
+      issuerRef = {
+        name = "homelab-ca"
+        kind = "ClusterIssuer"
+      }
+      duration    = "2160h"
+      renewBefore = "720h"
+    }
+  }
+
+  field_manager {
+    name = "terraform"
+  }
+
+  depends_on = [
+    kubernetes_manifest.homelab_ca_issuer,
+    kubernetes_namespace.namespaces
+  ]
+}