diff --git a/contrib/chart/backstage/README.md b/contrib/chart/backstage/README.md
index 4f247252b1..9d1c93765b 100644
--- a/contrib/chart/backstage/README.md
+++ b/contrib/chart/backstage/README.md
@@ -62,13 +62,30 @@ backstage-ingress   *       123.1.2.3       80      17m
 
 > **NOTE**: this is not a production ready deployment.
 
-## Caveats
-
-The current implementation does not generate certificates for the ingress which means the browser will alert that the
-site is insecure and using self-signed certificates.
-
 ## Customization
 
+### Issue certificates
+
+These charts can install or reuse a `clusterIssuer` to generate certificates for the backstage `ingress`. To do that:
+
+1. [Install][install-cert-manager] or make sure [cert-manager][cert-manager] is installed in the cluster.
+2. Enable the issuer in the charts. This will first check if there is a `letsencrypt` issuer already deployed in your
+   cluster and deploy one if it doesn't exist.
+
+To enable it you need to provide a valid email address in the chart's values:
+
+```
+issuer:
+  email: me@example.com
+  clusterIssuer: "letsencrypt-prod"
+```
+
+By default, the charts use `letsencrypt-staging` so in the above example we instruct helm to use the production issuer
+instead.
+
+[cert-manager]: https://cert-manager.io/docs/
+[install-cert-manager]: https://cert-manager.io/docs/installation/kubernetes/#installing-with-helm
+
 ### Custom PostgreSQL instance
 
 Configuring a connection to an existing PostgreSQL instance is possible through the chart's values.
diff --git a/contrib/chart/backstage/templates/ingress.yaml b/contrib/chart/backstage/templates/ingress.yaml
index 034862ef75..7231afda13 100644
--- a/contrib/chart/backstage/templates/ingress.yaml
+++ b/contrib/chart/backstage/templates/ingress.yaml
@@ -5,16 +5,25 @@ apiVersion: networking.k8s.io/v1beta1
 kind: Ingress
 metadata:
   name: {{ include "backstage.fullname" . }}-ingress
-  {{- with .Values.ingress.annotations }}
   annotations:
+    {{- if .Values.issuer.email }}
+    cert-manager.io/cluster-issuer: {{ .Values.issuer.clusterIssuer }}
+    {{- end }}
+    kubernetes.io/ingress.class: nginx
     nginx.ingress.kubernetes.io/ssl-redirect: "false"
     nginx.ingress.kubernetes.io/configuration-snippet: |
       if ($scheme = https) {
       add_header  Strict-Transport-Security "max-age=0;";
       }
-  {{- toYaml . | nindent 4 }}
-  {{- end }}
+    {{- toYaml .Values.ingress.annotations | nindent 4 }}
 spec:
+  tls:
+    - secretName: {{ include "backstage.fullname" . }}-tls
+      hosts:
+        - {{ $frontendUrl.host }}
+        - {{ $backendUrl.host }}
+        - {{ $lighthouseUrl.host }}
+
   rules:
     - host: {{ $frontendUrl.host }}
       http:
@@ -56,17 +65,22 @@ apiVersion: networking.k8s.io/v1beta1
 kind: Ingress
 metadata:
   name: {{ include "backstage.fullname" . }}-ingress-lighthouse
-  {{- with .Values.ingress.annotations }}
   annotations:
+    {{- if .Values.issuer.email }}
+    cert-manager.io/cluster-issuer: {{ .Values.issuer.clusterIssuer }}
+    {{- end }}
     nginx.ingress.kubernetes.io/rewrite-target: /$2
     nginx.ingress.kubernetes.io/ssl-redirect: "false"
     nginx.ingress.kubernetes.io/configuration-snippet: |
       if ($scheme = https) {
       add_header  Strict-Transport-Security "max-age=0;";
       }
-  {{- toYaml . | nindent 4 }}
-  {{- end }}
+    {{- toYaml .Values.ingress.annotations | nindent 4 }}
 spec:
+  tls:
+    - secretName: {{ include "backstage.fullname" . }}-tls
+      hosts:
+        - {{ $lighthouseUrl.host }}
   rules:
     - host: {{ $frontendUrl.host }}
       http:
diff --git a/contrib/chart/backstage/templates/issuer.yaml b/contrib/chart/backstage/templates/issuer.yaml
new file mode 100644
index 0000000000..d129c8c701
--- /dev/null
+++ b/contrib/chart/backstage/templates/issuer.yaml
@@ -0,0 +1,19 @@
+{{- if (and (.Capabilities.APIVersions.Has "cert-manager.io/v1alpha2") .Values.issuer.email )  -}}
+{{/*  Only install issuer if it doesn't already exist in the cluster */}}
+{{- if not ( lookup "cert-manager.io/v1alpha2" "ClusterIssuer"  "" .Values.issuer.clusterIssuer  ) }}
+apiVersion: cert-manager.io/v1alpha2
+kind: ClusterIssuer
+metadata:
+  name: {{ .Values.issuer.clusterIssuer }}
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: {{ required "expected a valid .Values.issuer.email to enable ClusterIssuer" .Values.issuer.email }}
+    privateKeySecretRef:
+      name: {{ required "expected .Values.issuer.cluster-issuer to not be empty (letsencrypt-prod | letsencrypt-staging)" .Values.issuer.clusterIssuer }}
+    solvers:
+    - http01:
+        ingress:
+          class: nginx
+{{- end -}}
+{{- end -}}
diff --git a/contrib/chart/backstage/values.yaml b/contrib/chart/backstage/values.yaml
index eec9c8fbe9..d51f1016d9 100644
--- a/contrib/chart/backstage/values.yaml
+++ b/contrib/chart/backstage/values.yaml
@@ -61,6 +61,10 @@ ingress:
   annotations:
     kubernetes.io/ingress.class: nginx
 
+issuer:
+  email:
+  clusterIssuer: 'letsencrypt-staging'
+
 global:
   postgresql:
     postgresqlUsername: backend-user