diff --git a/platform/staging/cert-manager.yaml b/platform/staging/cert-manager.yaml
index 26adbb5..e4ba8eb 100644
--- a/platform/staging/cert-manager.yaml
+++ b/platform/staging/cert-manager.yaml
@@ -27,7 +27,37 @@ spec:
     createNamespace: true
   values:
     config:
+      enableGatewayAPI: true
       featureGates:
         ACMEHTTP01IngressPathTypeExact: false
     crds:
       enabled: true
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: cloudflare-api-token
+  namespace: cert-manager
+  annotations:
+    # TODO dedicated SA for cert-manager
+    vault.security.banzaicloud.io/vault-addr: http://vault.vault.svc.cluster.local:8200
+    vault.security.banzaicloud.io/vault-role: default
+    vault.security.banzaicloud.io/vault-path: kubernetes
+stringData:
+  api-token: vault:secret/data/platform/cloudflare#API_TOKEN
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      name: letsencrypt-account-key
+    solvers:
+      - dns01:
+          cloudflare:
+            apiTokenSecretRef:
+              name: cloudflare-api-token
+              key: api-token
diff --git a/platform/staging/istio.yaml b/platform/staging/istio.yaml
index d995cce..c9fc7c3 100644
--- a/platform/staging/istio.yaml
+++ b/platform/staging/istio.yaml
@@ -95,13 +95,18 @@ kind: Gateway
 metadata:
   name: gateway
   namespace: istio-system # TODO dedicated namespace?
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
 spec:
   gatewayClassName: istio
   listeners:
-  - name: default
-    hostname: "*.staging.khuedoan.com" # TODO make this var/configurable
-    port: 80 # TODO HTTPS by default, only use HTTP for ACME HTTP-01
-    protocol: HTTP
+  - name: https
+    hostname: "*.staging.khuedoan.com"
+    port: 443
+    protocol: HTTPS
+    tls:
+      certificateRefs:
+        - name: wildcard-tls
     allowedRoutes:
       namespaces:
         from: All