diff --git a/kubernetes/ingress.yaml b/kubernetes/ingress.yaml
index 99ecd71..33375d8 100644
--- a/kubernetes/ingress.yaml
+++ b/kubernetes/ingress.yaml
@@ -3,6 +3,8 @@ kind: Ingress
 metadata:
   name: git-repo
   namespace: bioc-code-explorer
+  annotations:
+    cert-manager.io/issuer: letsencrypt
 spec:
   ingressClassName: "external-users"
   rules:
@@ -33,7 +35,7 @@ spec:
   tls:
   - hosts:
     - code.bioconductor.org
-  - secretName: certs
+    secretName: certs
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -42,6 +44,7 @@ metadata:
   namespace: bioc-code-explorer
   annotations:
     traefik.ingress.kubernetes.io/router.middlewares: "global-stripprefix@file"
+    cert-manager.io/issuer: letsencrypt
 spec:
   ingressClassName: "external-users"
   rules:
@@ -58,5 +61,5 @@ spec:
   tls:
   - hosts:
     - code.bioconductor.org
-  - secretName: certs
+    secretName: certs
 
diff --git a/kubernetes/issuer.yaml b/kubernetes/issuer.yaml
new file mode 100644
index 0000000..dca35a2
--- /dev/null
+++ b/kubernetes/issuer.yaml
@@ -0,0 +1,16 @@
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: letsencrypt
+  namespace: bioc-code-explorer
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: hugo.gruson@embl.de
+    privateKeySecretRef:
+      name: letsencrypt-account-key
+    solvers:
+      - http01:
+          ingress:
+            ingressClassName: external-users
+            serviceType: ClusterIP
diff --git a/kubernetes/secret.txt b/kubernetes/secret.txt
deleted file mode 100644
index 38d59d3..0000000
--- a/kubernetes/secret.txt
+++ /dev/null
@@ -1,19 +0,0 @@
-## We use the following lines to create the kubernetes secret that stores the 
-## Bioconductor website certificates.  You need the GoDaddy bundle and Bioconductor
-## certificate files, and the Bioconductor private key to create this secret.
-## Those are not stored in this repository, and it is assumed anyone implementing
-## this has access to them via another means.
-
-## following from https://pakstech.com/blog/kubernetes-tls-secret/
-
-
-cat /tmp/a14f0348e7f2bbee.crt /tmp/gd_bundle-g2-g1.crt > /tmp/bioconductor.crt
-kubectl create secret generic certs --from-file=tls.crt=/tmp/bioconductor.crt --from-file=tls.key=/tmp/bioconductor.key -n bioc-code-explorer
-
-
-## we also create a secret to store the nginx auth credentials
-## this assumes we create file locally a gitlist/goaccess/nginx.htpasswd using htpasswd
-htpasswd -c gitlist/goaccess/nginx.htpasswd admin
-
-kubectl create secret generic nginx-auth-secret \
-  --from-file=gitlist/goaccess/nginx.htpasswd --namespace=bioc-code-explorer