diff --git a/README.md b/README.md
index 1b8c4aa..cf5d659 100644
--- a/README.md
+++ b/README.md
@@ -17,7 +17,7 @@ Clone the liip/pontsun repository anywhere. Then `cd` to the working copy.
 
 Create an envfile
 
-```bash
+```sh
 cp ./containers/.env.example ./containers/.env
 ```
 
@@ -25,16 +25,15 @@ Adapt the `./containers/.env` file as needed.
 
 Create certificates for HTTPS
 
-```bash
-chmod u+x ./scripts/generate-certificates.sh
-./scripts/generate-certificates.sh
+```sh
+USER_ID=$(id -u) docker-compose -f docker-compose.certificates.yml up
 ```
 
-You can add the fake root CA authority certificate `certificates/docker.rootCA.crt` to your browser authorities in order to let it trust the concerned local developement instances.
+You can add the fake root CA authority certificate `certificates/docker.test.rootCA.crt` to your browser authorities in order to let it trust the concerned local developement instances.
 
 ## Start Traefik and Portainer
 
-```bash
+```sh
 cd containers
 docker-compose up -d
 ```
diff --git a/containers/.env.example b/containers/.env.example
index 29f41df..9a84efb 100644
--- a/containers/.env.example
+++ b/containers/.env.example
@@ -18,3 +18,5 @@ PONTSUN_NETWORK=pontsun
 PORTAINER_TAG=1.22.1
 # https://hub.docker.com/_/traefik
 TRAEFIK_TAG=1.7.18-alpine
+# https://hub.docker.com/r/liip/ssl-keygen
+SSL_KEYGEN_TAG=1.0.0
diff --git a/containers/docker-compose.certificates.yml b/containers/docker-compose.certificates.yml
new file mode 100644
index 0000000..68a5422
--- /dev/null
+++ b/containers/docker-compose.certificates.yml
@@ -0,0 +1,17 @@
+version: '3.5'
+services:
+
+  ssl-keygen:
+      image: liip/ssl-keygen:$SSL_KEYGEN_TAG
+      container_name: 'pontsun_ssl-keygen'
+      command: ls
+      environment:
+          OPENSSL_CERTIFICATE_SUBJECT_COUNTRY: CH
+          OPENSSL_CERTIFICATE_SUBJECT_STATE: FR
+          OPENSSL_CERTIFICATE_SUBJECT_LOCATION: Fribourg
+          OPENSSL_CERTIFICATE_SUBJECT_ORGANIZATION: Liip
+          OPENSSL_CERTIFICATE_SUBJECT_ORGANIZATION_UNIT: Pontsun
+          SITE_DOMAIN: $PROJECT_DOMAIN
+      volumes:
+          - ../certificates/:/certificates:rw
+      user: $USER_ID
diff --git a/containers/docker-compose.yml b/containers/docker-compose.yml
index c779d32..6d9e965 100644
--- a/containers/docker-compose.yml
+++ b/containers/docker-compose.yml
@@ -13,9 +13,9 @@ services:
       --docker.exposedByDefault=false \
       --defaultEntryPoints='https' \
       --defaultEntryPoints='http' \
-      --rootCAs='/certs/${PROJECT_NAME}.rootCA.crt' \
+      --rootCAs='/certs/${PROJECT_DOMAIN}.rootCA.crt' \
       --entryPoints='Name:http Address::80' \
-      --entryPoints='Name:https Address::443 TLS:/certs/${PROJECT_NAME}.crt,/certs/${PROJECT_NAME}.key' \
+      --entryPoints='Name:https Address::443 TLS:/certs/${PROJECT_DOMAIN}.crt,/certs/${PROJECT_DOMAIN}.key' \
       --logLevel=ERROR
     restart: always
     ports:
diff --git a/scripts/generate-certificates.sh b/scripts/generate-certificates.sh
deleted file mode 100755
index 1d342f0..0000000
--- a/scripts/generate-certificates.sh
+++ /dev/null
@@ -1,36 +0,0 @@
-#!/bin/bash
-set -e
-
-# Load env file
-set -a
-test -f $(dirname $0)/../containers/.env && source $(dirname $0)/../containers/.env
-set +a
-
-cd $(dirname $0)/../certificates
-
-if [ -f $PROJECT_NAME.crt ]; then
-    echo "Certificate already exists."
-else
-    subj="/C=CH/ST=FR/L=Fribourg/O=Liip/OU=Pontsun/CN=$PROJECT_NAME.$PROJECT_EXTENSION"
-
-    # Prepare temporary openssl.cnf
-    OPENSSL_CNF=`mktemp`
-    cp ../config/openssl.cnf.partial $OPENSSL_CNF
-    cat <<EOF >> $OPENSSL_CNF
-[ alt_names ]
-DNS.1 = ${PROJECT_NAME}.${PROJECT_EXTENSION}
-DNS.2 = *.${PROJECT_NAME}.${PROJECT_EXTENSION}
-EOF
-
-    openssl genrsa -out $PROJECT_NAME.rootCA.key 4096
-    openssl req -x509 -new -nodes -key $PROJECT_NAME.rootCA.key -sha256 -days 1024 -out $PROJECT_NAME.rootCA.crt -subj "$subj"
-
-    openssl genrsa -out $PROJECT_NAME.key 4096
-    openssl req -new -sha256 -subj "$subj" -key $PROJECT_NAME.key -out $PROJECT_NAME.csr -config $OPENSSL_CNF
-    openssl x509 -req -in $PROJECT_NAME.csr -CA $PROJECT_NAME.rootCA.crt -CAkey $PROJECT_NAME.rootCA.key -CAcreateserial -out $PROJECT_NAME.crt -days 365 -extensions v3_req -extfile $OPENSSL_CNF
-
-    cat $PROJECT_NAME.crt $PROJECT_NAME.key > $PROJECT_NAME.pem
-    chmod 600 $PROJECT_NAME.key $PROJECT_NAME.pem
-
-    rm -f $OPENSSL_CNF
-fi