diff --git a/.gitignore b/.gitignore
index e0c63b4ec..d6fbce578 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,3 +8,6 @@ sbom-docker.json
 *_sbom.json
 *.out
 *.DS_Store
+*.pem
+*.crt
+*.key
diff --git a/GNUmakefile b/GNUmakefile
index fc07967c7..24b6b0b4d 100644
--- a/GNUmakefile
+++ b/GNUmakefile
@@ -5,6 +5,9 @@ GO?=	go
 DOCKER?=	docker
 SYFT ?= syft
 GRYPE ?= grype
+CP ?= cp
+MKDIR ?= mkdir -p
+MKCERT ?= mkcert
 
 DOCKER_BUILD_FLAGS?=
 DOCKER_BUILD=	DOCKER_BUILDKIT=1 $(DOCKER) build $(DOCKER_BUILD_FLAGS)
@@ -160,7 +163,7 @@ clean: ## Clean the project (node_modules and build artifacts)
 	$(RM) -rf coverage.out coverage.html
 
 .PHONY: stack-up
-stack-up: ## Start the docker stack as a deamon
+stack-up: compose/pebble/certs/rootCA.pem ## Start the docker stack as a deamon
 	$(DOCKER_COMPOSE) up -d
 
 .PHONY: stack-down
@@ -182,3 +185,11 @@ goreleaser-snapshot: ## Build a snapshot release with goreleaser
 .PHONY: goreleaser-check
 goreleaser-check: ## Check goreleaser configuration
 	goreleaser check
+
+compose/pebble/certs/rootCA.pem:
+	@$(MKDIR) -p compose/pebble/certs
+	$(MKCERT) -cert-file compose/pebble/certs/pebble.crt \
+		-key-file compose/pebble/certs/pebble.key \
+		localhost 127.0.0.1 ::1 pebble
+	$(CP) "$$($(MKCERT) -CAROOT)/rootCA.pem" compose/pebble/certs/rootCA.pem
+	$(CP) "$$($(MKCERT) -CAROOT)/rootCA-key.pem" compose/pebble/certs/rootCA-key.pem
diff --git a/compose/pebble/pebble-config.json b/compose/pebble/pebble-config.json
index f2a30927b..70d0f1b6c 100644
--- a/compose/pebble/pebble-config.json
+++ b/compose/pebble/pebble-config.json
@@ -2,12 +2,13 @@
   "pebble": {
     "listenAddress": "0.0.0.0:14000",
     "managementListenAddress": "0.0.0.0:15000",
-    "certificate": "test/certs/localhost/cert.pem",
-    "privateKey": "test/certs/localhost/key.pem",
+    "certificate": "/test/config/certs/pebble.crt",
+    "privateKey": "/test/config/certs/pebble.key",
     "httpPort": 5002,
     "tlsPort": 5001,
     "ocspResponderURL": "",
     "externalAccountBindingRequired": false,
-    "domainBlocklist": []
+    "domainBlocklist": [],
+    "certificateValidityPeriod": 157766400
   }
 }