diff --git a/waltid-applications/waltid-web-portal/k8s/deployment-dev.yaml b/waltid-applications/waltid-web-portal/k8s/deployment-dev.yaml
index 8205476f0..cb989219c 100644
--- a/waltid-applications/waltid-web-portal/k8s/deployment-dev.yaml
+++ b/waltid-applications/waltid-web-portal/k8s/deployment-dev.yaml
@@ -51,7 +51,12 @@ metadata:
   name: portal-ingress
   annotations:
     kubernetes.io/ingress.class: "nginx"
+    cert-manager.io/cluster-issuer: letsencrypt-prod
 spec:
+  tls:
+    - hosts:
+        - portal.test.waltid.cloud
+      secretName: web-portal-tls-secret
   rules:
     - host: portal.test.waltid.cloud
       http:
diff --git a/waltid-services/waltid-issuer-api/k8s/deployment-dev.yaml b/waltid-services/waltid-issuer-api/k8s/deployment-dev.yaml
index 1e28edc4e..6751093dc 100644
--- a/waltid-services/waltid-issuer-api/k8s/deployment-dev.yaml
+++ b/waltid-services/waltid-issuer-api/k8s/deployment-dev.yaml
@@ -65,7 +65,12 @@ metadata:
   name: issuer
   annotations:
     kubernetes.io/ingress.class: "nginx"
+    cert-manager.io/cluster-issuer: letsencrypt-prod
 spec:
+  tls:
+    - hosts:
+        - issuer.portal.test.waltid.cloud
+      secretName: issuer-tls-secret
   rules:
     - host: issuer.portal.test.waltid.cloud
       http:
diff --git a/waltid-services/waltid-verifier-api/k8s/deployment-dev.yaml b/waltid-services/waltid-verifier-api/k8s/deployment-dev.yaml
index 9cb7b1fca..81176b295 100644
--- a/waltid-services/waltid-verifier-api/k8s/deployment-dev.yaml
+++ b/waltid-services/waltid-verifier-api/k8s/deployment-dev.yaml
@@ -74,7 +74,12 @@ metadata:
   name: verifier
   annotations:
     kubernetes.io/ingress.class: "nginx"
+    cert-manager.io/cluster-issuer: letsencrypt-prod
 spec:
+  tls:
+    - hosts:
+        - verifier.portal.test.waltid.cloud
+      secretName: verifier-tls-secret
   rules:
     - host: verifier.portal.test.waltid.cloud
       http:
diff --git a/waltid-services/waltid-verifier-api/k8s/opa/deployment-dev.yaml b/waltid-services/waltid-verifier-api/k8s/opa/deployment-dev.yaml
index 2fced763f..715d22b37 100644
--- a/waltid-services/waltid-verifier-api/k8s/opa/deployment-dev.yaml
+++ b/waltid-services/waltid-verifier-api/k8s/opa/deployment-dev.yaml
@@ -47,7 +47,12 @@ metadata:
   name: opa-ingress
   annotations:
     kubernetes.io/ingress.class: "nginx"
+    cert-manager.io/cluster-issuer: letsencrypt-prod
 spec:
+  tls:
+    - hosts:
+        - opa.test.waltid.cloud
+      secretName: opa-tls-secret
   rules:
     - host: opa.test.waltid.cloud
       http:
diff --git a/waltid-services/waltid-wallet-api/k8s/deployment-dev.yaml b/waltid-services/waltid-wallet-api/k8s/deployment-dev.yaml
index 36708fdc6..87934d448 100644
--- a/waltid-services/waltid-wallet-api/k8s/deployment-dev.yaml
+++ b/waltid-services/waltid-wallet-api/k8s/deployment-dev.yaml
@@ -238,11 +238,19 @@ metadata:
   name: wallet-ingress
   annotations:
     kubernetes.io/ingress.class: "nginx"
+    cert-manager.io/cluster-issuer: letsencrypt-prod
     ingress.kubernetes.io/configuration-snippet: |
       if ($host ~ ^(.+)\.waltid\.org$) {
         return 301 https://$1.walt-test.cloud$request_uri;
       }
 spec:
+  tls:
+    - hosts:
+        - wallet.test.waltid.cloud
+      secretName: wallet-demo-tls-secret
+    - hosts:
+        - wallet-dev.test.waltid.cloud
+      secretName: wallet-dev-tls-secret
   rules:
     - host: wallet-dev.test.waltid.cloud
       http: