diff --git a/README.md b/README.md
index 88764b373ed194fc040912119731973f919a842a..d290db31c51e9ecf0466c8281801a71f927523e5 100755
--- a/README.md
+++ b/README.md
@@ -77,7 +77,26 @@ Proxy service configuraion parameters and their defaults:
 
       - SAFEMODE=false
       - ROSETTA_HOST=localhost
+      - ROSETTA_TASKS_PROXY_HOST=$ROSETTA_HOST
+
+
+### Certificates for the proxy
+
+Certificates can be automatically handled with Letsencrypt. By default, a snakeoil certificate is used. To set up letsencrypt, first of all run inside the proxy (only once in its lifetime):
+
+	$ sudo rm -rf /etc/letsencrypt/live/YOUR_ROSETTA_HOST (or ROSETTA_TASKS_PROXY_HOST)
+
+Then, edit the `/etc/apache2/sites-available/proxy-global.conf` file and change the certificates for the domain that you want to enable with Letsencrypt to use snakeoils (otherwise nex comamnd will fail), then:
 
+	$  sudo apache2ctl -k graceful
+
+Now:
+
+    $ sudo certbot certonly --apache --register-unsafely-without-email --agree-tos -d YOUR_ROSETTA_HOST (or ROSETTA_TASKS_PROXY_HOST)
+    
+...or for the domain that you want to enable with Letsencrypt. This will initialize the certificate in /etc/letsencypt, which is stored on the host in `./data/proxy/letsencrypt`
+
+Finally, re-change the `/etc/apache2/sites-available/proxy-global.conf` file to use the correct certificates for the domain (or just restart the proxy service but wiht clean and then run).
 
 ### User types 
 In Rosetta there are two user types: standard users and power users. Their type is set in their user profile, and only power users can:
@@ -124,17 +143,36 @@ Note that when you edit the Django ORM model, you need to make migrations and ap
 
 
     
-### Logs and testing
+### Testing
 
 Run Web App unit tests (with Rosetta running)
+    
+    $ rosetta/test
 
-    $ rosetta/logs webapp
+
+### Logs
+
+
+Chek out logs for Docker containers (including entrypoints):
+
+
+    $ rosetta/logs web
+
+    $ rosetta/logs proxy
+
+
+Chek out logs for supervisord services:
+
+        
+    $ rosetta/logs web startup
     
-    $ rosetta/logs webapp startup
+    $ rosetta/logs web server
+
+    $ rosetta/logs proxy apache
+    
+    $ rosetta/logs proxy certbot
     
-    $ rosetta/logs webapp server
     
-    $ rosetta/test
     
     
 ### Computing resources requirements
diff --git a/docker-compose-dev.yml b/docker-compose-dev.yml
index ef5a65aa3f354a50de9330ced9bc77182a08a764..32de0b2cca9011e15956e7a62f2fb67fb5fb83a7 100644
--- a/docker-compose-dev.yml
+++ b/docker-compose-dev.yml
@@ -85,14 +85,16 @@ services:
     environment:
       - SAFEMODE=False
       - ROSETTA_HOST=localhost
+      - ROSETTA_TASKS_PROXY_HOST=localhost
     ports:
       - "80:80"
       - "443:443"
       - "9000-9020:9000-9020"
       - "5000:5000"
     volumes:
-      - ./data/shared:/shared   
-
+      - ./data/shared:/shared
+      - ./data/proxy/letsencrypt:/etc/letsencrypt
+      - ./data/proxy/log:/var/log/proxy
 
 
 
diff --git a/rosetta/clean b/rosetta/clean
index 46599c331538fae2ea3232a26e76179211de1171..6ee6b6d22de877608477c48ac69dda751fd4dd08 100755
--- a/rosetta/clean
+++ b/rosetta/clean
@@ -9,5 +9,5 @@ fi
 if [[ $# -eq 0 ]] ; then
     docker-compose down
 else
-    docker-compose down $@
+    docker-compose rm -s -v -f $@
 fi
diff --git a/rosetta/setup b/rosetta/setup
index 70b60813adcf902ed47b7c5d27f6dbef0bfa9768..2a9103de985ac6abe9e895b950fffa5f62654c27 100755
--- a/rosetta/setup
+++ b/rosetta/setup
@@ -9,15 +9,6 @@ else
 fi
 
 
-# Use dev certificates if not already set up
-if [ ! -d services/proxy/certificates ]; then
-    echo "Using dev certificates."
-    cp -a services/proxy/certificates-dev  services/proxy/certificates
-else
-    echo "Not using dev certificates as certificates are already present."
-fi
-
-
 # Use dev docker-compose.yml if not already set up
 if [ ! -f docker-compose.yml ]; then
     echo "Using dev docker-compose.yml"
diff --git a/services/proxy/Dockerfile b/services/proxy/Dockerfile
index 3da9629f1c13dac8cb94ae20dc558ec11062778d..d80660ee2cb5b96f84895751b58cb81787dc3b3c 100644
--- a/services/proxy/Dockerfile
+++ b/services/proxy/Dockerfile
@@ -10,10 +10,17 @@ RUN apt-get update
 RUN apt-get install -y apache2
 RUN apt-get install apache2-utils
 
-# Copy conf
+# Install Certbot
+RUN apt-get install certbot python3-certbot-apache -y
+
+# Supervisord scripts
 COPY supervisord_apache.conf /etc/supervisor/conf.d/
-COPY run_Apache.sh /etc/supervisor/conf.d/
-RUN chmod 755 /etc/supervisor/conf.d/run_Apache.sh
+COPY run_apache.sh /etc/supervisor/conf.d/
+RUN chmod 755 /etc/supervisor/conf.d/run_apache.sh
+
+COPY supervisord_certbot.conf /etc/supervisor/conf.d/
+COPY run_certbot.sh /etc/supervisor/conf.d/
+RUN chmod 755 /etc/supervisor/conf.d/run_certbot.sh
 
 # Enable mod_proxy and SSL
 RUN a2enmod proxy
@@ -22,21 +29,21 @@ RUN sudo a2enmod ssl
 RUN a2enmod rewrite
 RUN a2enmod headers
 RUN a2enmod proxy_wstunnel
- 
+
 # Clean up default stuff
 RUN rm /etc/apache2/sites-available/000-default.conf
 RUN rm /etc/apache2/sites-enabled/000-default.conf
 RUN rm /etc/apache2/sites-available/default-ssl.conf
 #RUN rm /etc/apache2/sites-enabled/default-ssl.conf
 
-# Copy certificates (snakeoil or real)
-RUN mkdir /certificates
-COPY certificates/rosetta_platform.crt /root/certificates/rosetta_platform/rosetta_platform.crt
-COPY certificates/rosetta_platform.key /root/certificates/rosetta_platform/rosetta_platform.key
-COPY certificates/rosetta_platform.ca-bundle /root/certificates/rosetta_platform/rosetta_platform.ca-bundle
-COPY certificates/rosetta_tasks.crt /root/certificates/rosetta_platform/rosetta_tasks.crt
-COPY certificates/rosetta_tasks.key /root/certificates/rosetta_platform/rosetta_tasks.key
-COPY certificates/rosetta_tasks.ca-bundle /root/certificates/rosetta_platform/rosetta_tasks.ca-bundle
+# Apache conf
+COPY apache2.conf /etc/apache2/apache2.conf 
+
+# Copy self-signed (snakeoil) certificates
+RUN mkdir /root/certificates
+COPY certificates/selfsigned.crt /root/certificates/selfsigned.crt
+COPY certificates/selfsigned.key /root/certificates/selfsigned.key
+COPY certificates/selfsigned.ca-bundle /root/certificates/selfsigned.ca-bundle
 
 # Copy index and norobots.txt
 COPY index.html /var/www/html/
diff --git a/services/proxy/apache2.conf b/services/proxy/apache2.conf
new file mode 100644
index 0000000000000000000000000000000000000000..c98a8e3ec753f43227ed4375a0e3bfa9d22062ab
--- /dev/null
+++ b/services/proxy/apache2.conf
@@ -0,0 +1,229 @@
+# This is the main Apache server configuration file.  It contains the
+# configuration directives that give the server its instructions.
+# See http://httpd.apache.org/docs/2.4/ for detailed information about
+# the directives and /usr/share/doc/apache2/README.Debian about Debian specific
+# hints.
+#
+#
+# Summary of how the Apache 2 configuration works in Debian:
+# The Apache 2 web server configuration in Debian is quite different to
+# upstream's suggested way to configure the web server. This is because Debian's
+# default Apache2 installation attempts to make adding and removing modules,
+# virtual hosts, and extra configuration directives as flexible as possible, in
+# order to make automating the changes and administering the server as easy as
+# possible.
+
+# It is split into several files forming the configuration hierarchy outlined
+# below, all located in the /etc/apache2/ directory:
+#
+#   /etc/apache2/
+#   |-- apache2.conf
+#   |   `--  ports.conf
+#   |-- mods-enabled
+#   |   |-- *.load
+#   |   `-- *.conf
+#   |-- conf-enabled
+#   |   `-- *.conf
+#   `-- sites-enabled
+#       `-- *.conf
+#
+#
+# * apache2.conf is the main configuration file (this file). It puts the pieces
+#   together by including all remaining configuration files when starting up the
+#   web server.
+#
+# * ports.conf is always included from the main configuration file. It is
+#   supposed to determine listening ports for incoming connections which can be
+#   customized anytime.
+#
+# * Configuration files in the mods-enabled/, conf-enabled/ and sites-enabled/
+#   directories contain particular configuration snippets which manage modules,
+#   global configuration fragments, or virtual host configurations,
+#   respectively.
+#
+#   They are activated by symlinking available configuration files from their
+#   respective *-available/ counterparts. These should be managed by using our
+#   helpers a2enmod/a2dismod, a2ensite/a2dissite and a2enconf/a2disconf. See
+#   their respective man pages for detailed information.
+#
+# * The binary is called apache2. Due to the use of environment variables, in
+#   the default configuration, apache2 needs to be started/stopped with
+#   /etc/init.d/apache2 or apache2ctl. Calling /usr/bin/apache2 directly will not
+#   work with the default configuration.
+
+
+# Global configuration
+#
+
+#
+# ServerRoot: The top of the directory tree under which the server's
+# configuration, error, and log files are kept.
+#
+# NOTE!  If you intend to place this on an NFS (or otherwise network)
+# mounted filesystem then please read the Mutex documentation (available
+# at <URL:http://httpd.apache.org/docs/2.4/mod/core.html#mutex>);
+# you will save yourself a lot of trouble.
+#
+# Do NOT add a slash at the end of the directory path.
+#
+#ServerRoot "/etc/apache2"
+
+#
+# The accept serialization lock file MUST BE STORED ON A LOCAL DISK.
+#
+#Mutex file:${APACHE_LOCK_DIR} default
+
+#
+# The directory where shm and other runtime files will be stored.
+#
+
+DefaultRuntimeDir ${APACHE_RUN_DIR}
+
+#
+# PidFile: The file in which the server should record its process
+# identification number when it starts.
+# This needs to be set in /etc/apache2/envvars
+#
+PidFile ${APACHE_PID_FILE}
+
+#
+# Timeout: The number of seconds before receives and sends time out.
+#
+Timeout 300
+
+#
+# KeepAlive: Whether or not to allow persistent connections (more than
+# one request per connection). Set to "Off" to deactivate.
+#
+KeepAlive On
+
+#
+# MaxKeepAliveRequests: The maximum number of requests to allow
+# during a persistent connection. Set to 0 to allow an unlimited amount.
+# We recommend you leave this number high, for maximum performance.
+#
+MaxKeepAliveRequests 100
+
+#
+# KeepAliveTimeout: Number of seconds to wait for the next request from the
+# same client on the same connection.
+#
+KeepAliveTimeout 5
+
+
+# These need to be set in /etc/apache2/envvars
+User ${APACHE_RUN_USER}
+Group ${APACHE_RUN_GROUP}
+
+#
+# HostnameLookups: Log the names of clients or just their IP addresses
+# e.g., www.apache.org (on) or 204.62.129.132 (off).
+# The default is off because it'd be overall better for the net if people
+# had to knowingly turn this feature on, since enabling it means that
+# each client request will result in AT LEAST one lookup request to the
+# nameserver.
+#
+HostnameLookups Off
+
+# ErrorLog: The location of the error log file.
+# If you do not specify an ErrorLog directive within a <VirtualHost>
+# container, error messages relating to that virtual host will be
+# logged here.  If you *do* define an error logfile for a <VirtualHost>
+# container, that host's errors will be logged there and not here.
+#
+#ErrorLog ${APACHE_LOG_DIR}/error.log
+ErrorLog /dev/stderr
+TransferLog /dev/stdout
+
+#
+# LogLevel: Control the severity of messages logged to the error_log.
+# Available values: trace8, ..., trace1, debug, info, notice, warn,
+# error, crit, alert, emerg.
+# It is also possible to configure the log level for particular modules, e.g.
+# "LogLevel info ssl:warn"
+#
+LogLevel warn
+
+# Include module configuration:
+IncludeOptional mods-enabled/*.load
+IncludeOptional mods-enabled/*.conf
+
+# Include list of ports to listen on
+Include ports.conf
+
+
+# Sets the default security model of the Apache2 HTTPD server. It does
+# not allow access to the root filesystem outside of /usr/share and /var/www.
+# The former is used by web applications packaged in Debian,
+# the latter may be used for local directories served by the web server. If
+# your system is serving content from a sub-directory in /srv you must allow
+# access here, or in any related virtual host.
+<Directory />
+    Options FollowSymLinks
+    AllowOverride None
+    Require all denied
+</Directory>
+
+<Directory /usr/share>
+    AllowOverride None
+    Require all granted
+</Directory>
+
+<Directory /var/www/>
+    Options Indexes FollowSymLinks
+    AllowOverride None
+    Require all granted
+</Directory>
+
+#<Directory /srv/>
+#   Options Indexes FollowSymLinks
+#   AllowOverride None
+#   Require all granted
+#</Directory>
+
+
+
+
+# AccessFileName: The name of the file to look for in each directory
+# for additional configuration directives.  See also the AllowOverride
+# directive.
+#
+AccessFileName .htaccess
+
+#
+# The following lines prevent .htaccess and .htpasswd files from being
+# viewed by Web clients.
+#
+<FilesMatch "^\.ht">
+    Require all denied
+</FilesMatch>
+
+
+#
+# The following directives define some format nicknames for use with
+# a CustomLog directive.
+#
+# These deviate from the Common Log Format definitions in that they use %O
+# (the actual bytes sent including headers) instead of %b (the size of the
+# requested file), because the latter makes it impossible to detect partial
+# requests.
+#
+# Note that the use of %{X-Forwarded-For}i instead of %h is not recommended.
+# Use mod_remoteip instead.
+#
+LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined
+LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
+LogFormat "%h %l %u %t \"%r\" %>s %O" common
+LogFormat "%{Referer}i -> %U" referer
+LogFormat "%{User-agent}i" agent
+
+# Include of directories ignores editors' and dpkg's backup files,
+# see README.Debian for details.
+
+# Include generic snippets of statements
+IncludeOptional conf-enabled/*.conf
+
+# Include the virtual host configurations:
+IncludeOptional sites-enabled/*.conf
+
+# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
\ No newline at end of file
diff --git a/services/proxy/prestartup_proxy.sh b/services/proxy/prestartup_proxy.sh
index 2ff975caf7bfdb3728b09b846f1364bd246221dd..aac3083f5eb394ddd2061a5072ccba958d0b91bd 100644
--- a/services/proxy/prestartup_proxy.sh
+++ b/services/proxy/prestartup_proxy.sh
@@ -1 +1,74 @@
-# Nothing here..
+#!/bin/bash
+
+#-----------------------
+# Rosetta Platform
+#-----------------------
+
+# Always create dir if not existent
+mkdir -p /etc/letsencrypt/live/$ROSETTA_HOST/
+
+# If there are no certificates, use snakeoils
+if [ ! -f "/etc/letsencrypt/live/$ROSETTA_HOST/cert.pem" ]; then
+    echo "Using default self-signed certificate cer file for $ROSETTA_HOST as not existent..."
+    cp -a /root/certificates/selfsigned.crt /etc/letsencrypt/live/$ROSETTA_HOST/cert.pem
+else
+    echo "Not using default self-signed certificate cer file for $ROSETTA_HOST as already existent."
+fi
+
+if [ ! -f "/etc/letsencrypt/live/$ROSETTA_HOST/privkey.pem" ]; then
+    echo "Using default self-signed certificate privkey file for $ROSETTA_HOST as not existent..."
+    cp -a /root/certificates/selfsigned.key /etc/letsencrypt/live/$ROSETTA_HOST/privkey.pem
+else
+    echo "Not using default self-signed certificate privkey file for $ROSETTA_HOST as already existent."
+fi
+
+if [ ! -f "/etc/letsencrypt/live/$ROSETTA_HOST/fullchain.pem" ]; then
+    echo "Using default self-signed certificate fullchain file for $ROSETTA_HOST as not existent..."
+    cp -a /root/certificates/selfsigned.ca-bundle /etc/letsencrypt/live/$ROSETTA_HOST/fullchain.pem
+else
+    echo "Not using default self-signed certificate fullchain file for $ROSETTA_HOST as already existent."
+fi
+
+# Replace the ROSETTA_HOST in the Apache proxy conf. Directly using an env var doen not wotk
+# with the letsencryot client, which has a bug: https://github.com/certbot/certbot/issues/8243
+sudo sed -i "s/__ROSETTA_HOST__/$ROSETTA_HOST/g" /etc/apache2/sites-available/proxy-global.conf
+    
+
+#-----------------------
+# Rosetta tasks
+#-----------------------
+
+# If the tasks host is equal to rosetta host or not set, do nothing as we have already habdled it above
+if [ "x$ROSETTA_TASKS_PROXY_HOST" == "x$ROSETTA_HOST"] || [ "x$ROSETTA_TASKS_PROXY_HOST" == "x" ]; then
+    echo "[INFO] Not setting up certificates forRosetta tasks host as qual to Rosetta main host"
+    ROSETTA_TASKS_PROXY_HOST=$ROSETTA_HOST
+else
+
+    # If there are no certificates, use snakeoils
+	if [ ! -f "/etc/letsencrypt/live/$ROSETTA_TASKS_PROXY_HOST/cert.pem" ]; then
+	    echo "Using default self-signed certificate cer file for $ROSETTA_TASKS_PROXY_HOST as not existent..."
+	    cp -a /root/certificates/selfsigned.crt /etc/letsencrypt/live/$ROSETTA_TASKS_PROXY_HOST/cert.pem
+	else
+	    echo "Not using default self-signed certificate cer file for $ROSETTA_TASKS_PROXY_HOST as already existent."
+	fi
+	
+	if [ ! -f "/etc/letsencrypt/live/$ROSETTA_TASKS_PROXY_HOST/privkey.pem" ]; then
+	    echo "Using default self-signed certificate privkey file for $ROSETTA_TASKS_PROXY_HOST as not existent..."
+	    cp -a /root/certificates/selfsigned.key /etc/letsencrypt/live/$ROSETTA_TASKS_PROXY_HOST/privkey.pem
+	else
+	    echo "Not using default self-signed certificate privkey file for $ROSETTA_TASKS_PROXY_HOST as already existent."
+	fi
+	
+	if [ ! -f "/etc/letsencrypt/live/$ROSETTA_TASKS_PROXY_HOST/fullchain.pem" ]; then
+	    echo "Using default self-signed certificate fullchain file for $ROSETTA_TASKS_PROXY_HOST as not existent..."
+	    cp -a /root/certificates/selfsigned.ca-bundle /etc/letsencrypt/live/$ROSETTA_TASKS_PROXY_HOST/fullchain.pem
+	else
+	    echo "Not using default self-signed certificate fullchain file for $ROSETTA_TASKS_PROXY_HOST as already existent."
+	fi
+
+fi
+
+# Replace the __ROSETTA_TASKS_PROXY_HOST__ in the Apache proxy conf. Directly using an env var doen not wotk
+# with the letsencryot client, which has a bug: https://github.com/certbot/certbot/issues/8243
+sudo sed -i "s/__ROSETTA_TASKS_PROXY_HOST__/$ROSETTA_TASKS_PROXY_HOST/g" /etc/apache2/sites-available/proxy-global.conf
+    
diff --git a/services/proxy/proxy-global.conf b/services/proxy/proxy-global.conf
index e0981dbfe8d4a2ed64741453ef173889476c761a..f3a94f7cab71d952a9eca07e063e3e8274883efa 100644
--- a/services/proxy/proxy-global.conf
+++ b/services/proxy/proxy-global.conf
@@ -1,44 +1,52 @@
-<VirtualHost *:80>
 
-    ServerAdmin admin@rosetta.platform
+# Note: if setting up Let's Encrypt, use these certificates for the 
+# intermediate step, according to the REANDE:
+# SSLCertificateFile /root/certificates/selfsigned.crt
+# SSLCertificateKeyFile /root/certificates/selfsigned.key
+# SSLCACertificateFile /root/certificates/selfsigned.ca-bundle
 
-    #----------------------------------
-    # Force https (except on localhost)
-    #----------------------------------
 
+#------------------------
+# Force https
+#------------------------
+<VirtualHost *:80>
+
+    ServerAdmin admin@rosetta.platform
     RewriteEngine On
     RewriteCond %{HTTPS} off
-    RewriteCond %{HTTP_HOST} !=localhost
     RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
-    
-    ProxyPass / http://webapp:8080/
-    ProxyPassReverse / http://webapp:8080/ 
     AllowEncodedSlashes NoDecode
        
 </VirtualHost>
 
 
+#------------------------
+# Catch-all
+#------------------------
 <VirtualHost *:443>
     ServerAdmin admin@rosetta.platform
     SSLEngine on
-    SSLCertificateFile /root/certificates/rosetta_platform/rosetta_platform.crt
-    SSLCertificateKeyFile /root/certificates/rosetta_platform/rosetta_platform.key
-    SSLCACertificateFile /root/certificates/rosetta_platform/rosetta_platform.ca-bundle
+    SSLCertificateFile /etc/letsencrypt/live/__ROSETTA_HOST__/cert.pem
+    SSLCertificateKeyFile /etc/letsencrypt/live/__ROSETTA_HOST__/privkey.pem
+    SSLCACertificateFile /etc/letsencrypt/live/__ROSETTA_HOST__/fullchain.pem
     DocumentRoot /var/www/html
 </VirtualHost>
 
 
+#------------------------
+#  Rosetta Platform
+#------------------------
 <VirtualHost *:443>
     ServerAdmin admin@rosetta.platform
-    ServerName ${ROSETTA_HOST}
+    ServerName __ROSETTA_HOST__
     ProxyPass / http://webapp:8080/
     ProxyPassReverse / http://webapp:8080/
     AllowEncodedSlashes NoDecode
 
     SSLEngine on
-    SSLCertificateFile /root/certificates/rosetta_platform/rosetta_platform.crt
-    SSLCertificateKeyFile /root/certificates/rosetta_platform/rosetta_platform.key
-    SSLCACertificateFile /root/certificates/rosetta_platform/rosetta_platform.ca-bundle
+    SSLCertificateFile /etc/letsencrypt/live/__ROSETTA_HOST__/cert.pem
+    SSLCertificateKeyFile /etc/letsencrypt/live/__ROSETTA_HOST__/privkey.pem
+    SSLCACertificateFile /etc/letsencrypt/live/__ROSETTA_HOST__/fullchain.pem
 
     # Browser-specific fixes
     BrowserMatch "MSIE [2-6]" \
@@ -51,18 +59,40 @@
 
 </VirtualHost>
 
+
+#------------------------
+#  Rosetta tasks
+#------------------------
+# This is actually a placeholder required in order to have Let's Encrypt to get the
+# certificates, as Apache conf fot hte tasks is injected by the webapp service.
+# If __ROSETTA_TASKS_PROXY_HOST__ is set qual to __ROSETTA_HOST__ as no dual
+# configuration is in place, then it simply gets overwritten by the entry above.
+
+<VirtualHost *:443>
+    ServerAdmin admin@rosetta.platform
+    ServerName __ROSETTA_TASKS_PROXY_HOST__
+    SSLEngine on
+    SSLCertificateFile /etc/letsencrypt/live/__ROSETTA_TASKS_PROXY_HOST__/cert.pem
+    SSLCertificateKeyFile /etc/letsencrypt/live/__ROSETTA_TASKS_PROXY_HOST__/privkey.pem
+    SSLCACertificateFile /etc/letsencrypt/live/__ROSETTA_TASKS_PROXY_HOST__/fullchain.pem
+    DocumentRoot /var/www/html
+</VirtualHost>
+
+
+#-------------------------
+#  The Docker registry
+#-------------------------
 Listen 5000
 <VirtualHost *:5000>
     ServerAdmin admin@rosetta.platform
-    #ServerName ${ROSETTA_HOST}
     ProxyPass / http://dregistry:5000/
     ProxyPassReverse / http://dregistry:5000/
 
     SSLEngine on
 
-    SSLCertificateFile /root/certificates/rosetta_platform/rosetta_platform.crt
-    SSLCertificateKeyFile /root/certificates/rosetta_platform/rosetta_platform.key
-    SSLCACertificateFile /root/certificates/rosetta_platform/rosetta_platform.ca-bundle
+    SSLCertificateFile /etc/letsencrypt/live/__ROSETTA_HOST__/cert.pem
+    SSLCertificateKeyFile /etc/letsencrypt/live/__ROSETTA_HOST__/privkey.pem
+    SSLCACertificateFile /etc/letsencrypt/live/__ROSETTA_HOST__/fullchain.pem
 
     # Browser-specific fixes
     BrowserMatch "MSIE [2-6]" \
diff --git a/services/proxy/run_Apache.sh b/services/proxy/run_apache.sh
similarity index 100%
rename from services/proxy/run_Apache.sh
rename to services/proxy/run_apache.sh
diff --git a/services/proxy/run_certbot.sh b/services/proxy/run_certbot.sh
new file mode 100644
index 0000000000000000000000000000000000000000..479a335c0085af4fa1873e1d325bc119da8c0455
--- /dev/null
+++ b/services/proxy/run_certbot.sh
@@ -0,0 +1,12 @@
+#!/bin/bash
+
+# Source env
+source /env.sh
+
+# Exec certbot renew every hour
+while true
+do
+    date
+    sudo certbot renew
+    sleep 86400
+done
diff --git a/services/proxy/supervisord_apache.conf b/services/proxy/supervisord_apache.conf
index a2dee4acd5362ea0688eb2f56570d1665d249584..5441be5ab43c3aac61d891e8b1793e05071bc0c5 100644
--- a/services/proxy/supervisord_apache.conf
+++ b/services/proxy/supervisord_apache.conf
@@ -5,7 +5,7 @@
 [program:apache]
  
 ; General
-command       = /etc/supervisor/conf.d/run_Apache.sh
+command       = /etc/supervisor/conf.d/run_apache.sh
 user          = root
 numprocs      = 1
 autostart     = true
@@ -14,10 +14,8 @@ startsecs     = 10
 stopwaitsecs  = 30
 process_name  = apache
  
-; Standard out / error
-stdout_logfile          = /var/log/supervisor/%(program_name)s.log
-stdout_logfile_maxbytes = 5MB
+; Log files
+stdout_logfile          = /var/log/proxy/apache.log
+stdout_logfile_maxbytes = 10MB
 stdout_logfile_backups  = 10
-stderr_logfile          = /var/log/supervisor/%(program_name)s.log
-stderr_logfile_maxbytes = 5MB
-stderr_logfile_backups  = 10
+redirect_stderr         = true
diff --git a/services/proxy/supervisord_certbot.conf b/services/proxy/supervisord_certbot.conf
new file mode 100644
index 0000000000000000000000000000000000000000..467902695f63ca2241ee1107a24ae1c40e89a5c6
--- /dev/null
+++ b/services/proxy/supervisord_certbot.conf
@@ -0,0 +1,21 @@
+;=======================================
+; Certbot service
+;=======================================
+ 
+[program:certbot]
+ 
+; General
+command       = /etc/supervisor/conf.d/run_certbot.sh
+user          = root
+numprocs      = 1
+autostart     = true
+autorestart   = true
+startsecs     = 10
+stopwaitsecs  = 30
+process_name  = certbot
+ 
+; Log files
+stdout_logfile          = /var/log/proxy/certbot.log
+stdout_logfile_maxbytes = 10MB
+stdout_logfile_backups  = 10
+redirect_stderr         = true