diff --git a/charts/gxf/Chart.yaml b/charts/gxf/Chart.yaml
index 96d7dbf..352c211 100644
--- a/charts/gxf/Chart.yaml
+++ b/charts/gxf/Chart.yaml
@@ -1,7 +1,7 @@
 apiVersion: v2
 name: gxf
 description: Generic GXF Helm chart
-version: '1.7.0'
+version: '1.8.0'
 icon: https://artwork.lfenergy.org/projects/grid-exchange-fabric/abbrev/color/grid-exchange-fabric-abbrev-color.png
 maintainers:
   - name: OSGP
diff --git a/charts/gxf/templates/certificate.yaml b/charts/gxf/templates/certificate.yaml
new file mode 100644
index 0000000..6d412bb
--- /dev/null
+++ b/charts/gxf/templates/certificate.yaml
@@ -0,0 +1,39 @@
+{{- range .Values.certificates }}
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: {{ $.Release.Name }}-{{ .name }}
+spec:
+  secretName: {{ $.Release.Name }}-{{ .name }}
+  duration: {{ .duration | default "8760h0m0s" }}
+  renewBefore: {{ .renewBefore | default "720h0m0s" }}
+  commonName: {{ .commonName }}
+  privateKey:
+    algorithm: RSA
+    size: 2048
+  {{- if .dnsNames }}
+  dnsNames:
+    {{- range .dnsNames }}
+    - {{ . }}
+    {{- end }}
+  {{- end }}
+  issuerRef:
+    name: {{ if $.issuerRefName }}{{ $.issuerRefName }}{{ else }}{{ printf "%s-ca-issuer" $.Release.Namespace }}{{ end }}
+    kind: {{ if $.issuerRefKind }}{{ $.issuerRefKind }}{{ else }}Issuer{{ end }}
+  usages:
+    {{- if .usages }}
+    {{- range .usages }}
+    - {{ . }}
+    {{- end }}
+    {{- else }}
+    - server auth
+    - client auth
+    {{- end }}
+  keystores:
+    pkcs12:
+      create: true
+      passwordSecretRef:
+        name: keystore-password
+        key: password
+---
+{{- end }}
diff --git a/charts/gxf/values.yaml b/charts/gxf/values.yaml
index 22f48f3..eadb185 100644
--- a/charts/gxf/values.yaml
+++ b/charts/gxf/values.yaml
@@ -104,3 +104,13 @@ logging:
   # filename: your-own-choosing (defaults to .Release.Name)
   maxHistoryDays: 3
   totalSizeCap: 2GB
+
+certificates: []
+  # - name: example-client-tls-cert
+  #   commonName: example-client
+  #   usages:
+  #     - client auth
+  # - name: example-server-tls-cert
+  #   commonName: example.com
+  #   dnsNames:
+  #     - example.com