diff --git a/infrastructure/cert-manager/duckdns-issuer.yaml b/infrastructure/cert-manager/duckdns-issuer.yaml
new file mode 100644
index 0000000..472008a
--- /dev/null
+++ b/infrastructure/cert-manager/duckdns-issuer.yaml
@@ -0,0 +1,33 @@
+# infrastructure/cert-manager/duckdns-issuer.yaml
+# apiVersion: cert-manager.io/v1
+# kind: ClusterIssuer
+# metadata:
+#   name: duckdns
+# spec:
+#   acme:
+#     server: https://acme-v02.api.letsencrypt.org/directory
+#     email: wulsspaans@gmail.com
+#     privateKeySecretRef:
+#       name: duckdns-account-key        # account-key wordt hierin opgeslagen
+#     solvers:
+#     - dns01:
+#         webhook:
+#           groupName: acme.duckdns.org   # <-- dit is de juiste waarde
+#           solverName: duckdns
+#           config:
+#             apiTokenSecretRef:          # <-- let op: niet secretName/subdomain!
+#               name: duckdns-token
+#               key: token
+
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: zb-kw.duckdns.org
+  namespace: services
+spec:
+  dnsNames:
+  - 'zb-kw.duckdns.org'
+  issuerRef:
+    name: cert-manager-webhook-duckdns-production
+    kind: ClusterIssuer
+  secretName: zb-kw-duckdns-org-tls
\ No newline at end of file