diff --git a/clusters/yc-ecp/kustomization.yaml b/clusters/yc-ecp/kustomization.yaml
index 139913c..3bb515f 100644
--- a/clusters/yc-ecp/kustomization.yaml
+++ b/clusters/yc-ecp/kustomization.yaml
@@ -5,5 +5,6 @@ resources:
   - ./helm-repositories.yaml
 
 # infrastructure
+  - ../../infrastructure/cert-manager/yc-ecp
   - ../../infrastructure/istio-config/yc-ecp
   - ../../infrastructure/vault/yc-ecp
diff --git a/infrastructure/cert-manager/yc-ecp/cert-manager.yaml b/infrastructure/cert-manager/yc-ecp/cert-manager.yaml
new file mode 100644
index 0000000..1cb5ad7
--- /dev/null
+++ b/infrastructure/cert-manager/yc-ecp/cert-manager.yaml
@@ -0,0 +1,12 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+spec:
+  interval: 5m
+  timeout: 10m
+  values:
+    global:
+      imagePullSecrets:
+        - dockerhub
diff --git a/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-delete.yaml b/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-delete.yaml
new file mode 100644
index 0000000..494e4ab
--- /dev/null
+++ b/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-delete.yaml
@@ -0,0 +1,5 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-issuer
+$patch: delete
diff --git a/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-istio-delete.yaml b/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-istio-delete.yaml
new file mode 100644
index 0000000..9901d81
--- /dev/null
+++ b/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-istio-delete.yaml
@@ -0,0 +1,5 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-issuer-istio
+$patch: delete
diff --git a/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-prod.yaml b/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-prod.yaml
new file mode 100644
index 0000000..3de8c09
--- /dev/null
+++ b/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-prod.yaml
@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    email: "sarex@sarex.io"
+    privateKeySecretRef:
+      name: letsencrypt-prod
+    server: "https://acme-v02.api.letsencrypt.org/directory"
+    solvers:
+      - http01:
+          ingress:
+            class: istio
\ No newline at end of file
diff --git a/infrastructure/cert-manager/yc-ecp/kustomization.yaml b/infrastructure/cert-manager/yc-ecp/kustomization.yaml
new file mode 100644
index 0000000..63bab8e
--- /dev/null
+++ b/infrastructure/cert-manager/yc-ecp/kustomization.yaml
@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+  - clusterissuer-letsencrypt-prod.yaml
+patches:
+  - path: cert-manager.yaml
+  # yc-ecp выпускает сертификаты только через letsencrypt-prod
+  - path: clusterissuer-letsencrypt-delete.yaml
+  - path: clusterissuer-letsencrypt-istio-delete.yaml