diff --git a/roles/atmosphere/defaults/main.yml b/roles/atmosphere/defaults/main.yml
index 5f20539..79c15e7 100644
--- a/roles/atmosphere/defaults/main.yml
+++ b/roles/atmosphere/defaults/main.yml
@@ -4,3 +4,4 @@
   memcached:
     secret_key: "{{ openstack_helm_endpoints_memcached_secret_key }}"
     overrides: "{{ openstack_helm_infra_memcached_values | default({}) }}"
+  issuer: "{{ atmosphere_issuer_config }}"
diff --git a/roles/atmosphere/templates/role.yml b/roles/atmosphere/templates/role.yml
index 47a0361..1a0a38e 100644
--- a/roles/atmosphere/templates/role.yml
+++ b/roles/atmosphere/templates/role.yml
@@ -14,3 +14,6 @@
   - apiGroups: ["rabbitmq.com"]
     resources: ["rabbitmqclusters"]
     verbs: ["get", "create", "patch"]
+  - apiGroups: ["cert-manager.io"]
+    resources: ["certificates", "issuers"]
+    verbs: ["get", "create", "patch"]
diff --git a/roles/cert_manager/README.md b/roles/cert_manager/README.md
deleted file mode 100644
index 77865d4..0000000
--- a/roles/cert_manager/README.md
+++ /dev/null
@@ -1 +0,0 @@
-# `cert_manager`
diff --git a/roles/cert_manager/defaults/main.yml b/roles/cert_manager/defaults/main.yml
deleted file mode 100644
index 183b22d..0000000
--- a/roles/cert_manager/defaults/main.yml
+++ /dev/null
@@ -1,35 +0,0 @@
----
-# .. vim: foldmarker=[[[,]]]:foldmethod=marker
-
-# .. Copyright (C) 2022 VEXXHOST, Inc.
-# .. SPDX-License-Identifier: Apache-2.0
-
-# Default variables
-# =================
-
-# .. contents:: Sections
-#    :local:
-
-
-# .. envvar:: cert_manager_acme_server [[[
-#
-# ACME server URL
-cert_manager_acme_server: "{{ lookup('env', 'ATMOSPHERE_ACME_SERVER') | default('https://acme-v02.api.letsencrypt.org/directory', True) }}"
-
-                                                                   # ]]]
-# .. envvar:: cert_manager_issuer [[[
-#
-# Definition for the ``cert-manager`` issuer
-# To use self-signed CA certificate, set cert_manager_issuer.ca.secretName as root-secret.
-cert_manager_issuer:
-  acme:
-    email: mnaser@vexxhost.com
-    server: "{{ cert_manager_acme_server }}"
-    privateKeySecretRef:
-      name: issuer-account-key
-    solvers:
-      - http01:
-          ingress:
-            class: openstack
-
-                                                                   # ]]]
diff --git a/roles/cert_manager/tasks/main.yml b/roles/cert_manager/tasks/main.yml
deleted file mode 100644
index c9c0901..0000000
--- a/roles/cert_manager/tasks/main.yml
+++ /dev/null
@@ -1,92 +0,0 @@
-# Copyright (c) 2022 VEXXHOST, Inc.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-- name: Create Issuer
-  kubernetes.core.k8s:
-    state: present
-    definition:
-      apiVersion: cert-manager.io/v1
-      kind: Issuer
-      metadata:
-        name: openstack
-        namespace: openstack
-      spec: "{{ cert_manager_issuer }}"
-  # NOTE(mnaser): Since we haven't moved to the operator pattern yet, we need to
-  #               keep retrying a few times as the CRDs might not be installed
-  #               yet.
-  retries: 60
-  delay: 5
-  register: _result
-  until: _result is not failed
-
-- name: Bootstrap self-signed PKI
-  block:
-    - name: Create self-signed issuer
-      kubernetes.core.k8s:
-        state: present
-        definition:
-          apiVersion: cert-manager.io/v1
-          kind: ClusterIssuer
-          metadata:
-            name: selfsigned-issuer
-          spec:
-            selfSigned: {}
-
-    - name: Bootstrap a custom root certificate for a private PKI
-      kubernetes.core.k8s:
-        state: present
-        definition:
-          apiVersion: cert-manager.io/v1
-          kind: Certificate
-          metadata:
-            name: selfsigned-ca
-            namespace: openstack
-          spec:
-            isCA: true
-            commonName: selfsigned-ca
-            secretName: root-secret
-            duration: 86400h # 3600d
-            renewBefore: 360h # 15d
-            privateKey:
-              algorithm: ECDSA
-              size: 256
-            issuerRef:
-              name: selfsigned-issuer
-              kind: ClusterIssuer
-              group: cert-manager.io
-
-    - name: Wait till the root secret is created
-      kubernetes.core.k8s_info:
-        api_version: v1
-        kind: Secret
-        wait: true
-        name: root-secret
-        namespace: openstack
-        wait_sleep: 10
-        wait_timeout: 300
-      register: _openstack_helm_root_secret
-
-    - name: Copy CA certificate on host
-      ansible.builtin.copy:
-        content: "{{ _openstack_helm_root_secret.resources[0].data['tls.crt'] | b64decode }}"
-        dest: "/usr/local/share/ca-certificates/self-signed-osh-ca.crt"
-        mode: "0644"
-
-    - name: Update ca certificates on host
-      ansible.builtin.command:
-        cmd: update-ca-certificates
-      changed_when: false
-  when:
-    - cert_manager_issuer.ca.secretName is defined
-    - cert_manager_issuer.ca.secretName == "root-secret"
diff --git a/roles/certificates/README.md b/roles/certificates/README.md
new file mode 100644
index 0000000..ab2904d
--- /dev/null
+++ b/roles/certificates/README.md
@@ -0,0 +1,6 @@
+# `certificates`
+
+!!! warning
+
+    This is a legacy role that is meant to be phased out eventually when there
+    is no need for the control-plane systems to have the CA installed on them.
diff --git a/roles/cert_manager/meta/main.yml b/roles/certificates/meta/main.yml
similarity index 92%
rename from roles/cert_manager/meta/main.yml
rename to roles/certificates/meta/main.yml
index 97154e4..4d6cbdd 100644
--- a/roles/cert_manager/meta/main.yml
+++ b/roles/certificates/meta/main.yml
@@ -14,7 +14,7 @@
 
 galaxy_info:
   author: VEXXHOST, Inc.
-  description: Ansible role for cert-manager
+  description: Ansible role for distributing certificates
   license: Apache-2.0
   min_ansible_version: 5.5.0
   standalone: false
diff --git a/roles/certificates/tasks/main.yml b/roles/certificates/tasks/main.yml
new file mode 100644
index 0000000..334d7e7
--- /dev/null
+++ b/roles/certificates/tasks/main.yml
@@ -0,0 +1,53 @@
+# Copyright (c) 2022 VEXXHOST, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+- name: Bootstrap PKI
+  block:
+    - name: Wait till the secret is created
+      kubernetes.core.k8s_info:
+        api_version: v1
+        kind: Secret
+        name: cert-manager-selfsigned-ca
+        namespace: openstack
+        wait: true
+        wait_sleep: 1
+        wait_timeout: 300
+      register: _openstack_helm_root_secret
+      when: atomsphere_issuer_config.type == "self-signed"
+
+    - name: Wait till the secret is created
+      kubernetes.core.k8s_info:
+        api_version: v1
+        kind: Secret
+        name: cert-manager-issuer-ca
+        namespace: openstack
+        wait: true
+        wait_sleep: 1
+        wait_timeout: 300
+      register: _openstack_helm_root_secret
+      when: atomsphere_issuer_config.type == "ca"
+
+    - name: Copy CA certificate on host
+      ansible.builtin.copy:
+        content: "{{ _openstack_helm_root_secret.resources[0].data['tls.crt'] | b64decode }}"
+        dest: "/usr/local/share/ca-certificates/self-signed-osh-ca.crt"
+        mode: "0644"
+
+    - name: Update CA certificates on host
+      ansible.builtin.command:
+        cmd: update-ca-certificates
+      changed_when: false
+  when:
+    - atomsphere_issuer_config.type is defined
+    - atomsphere_issuer_config.type in ("self-signed", "ca")
diff --git a/roles/openstack_cli/meta/main.yml b/roles/openstack_cli/meta/main.yml
index c18c9db..d1ef07b 100644
--- a/roles/openstack_cli/meta/main.yml
+++ b/roles/openstack_cli/meta/main.yml
@@ -22,3 +22,6 @@
     - name: Ubuntu
       versions:
         - focal
+
+dependencies:
+  - role: certificates
diff --git a/roles/openstacksdk/meta/main.yml b/roles/openstacksdk/meta/main.yml
index b328fac..7d9c3db 100644
--- a/roles/openstacksdk/meta/main.yml
+++ b/roles/openstacksdk/meta/main.yml
@@ -22,3 +22,6 @@
     - name: Ubuntu
       versions:
         - focal
+
+dependencies:
+  - role: certificates