diff --git a/board/common/rootfs/etc/finit.d/available/mkcert.conf b/board/common/rootfs/etc/finit.d/available/mkcert.conf
new file mode 100644
index 00000000..d2728616
--- /dev/null
+++ b/board/common/rootfs/etc/finit.d/available/mkcert.conf
@@ -0,0 +1 @@
+task [S] <service/confd/ready> mkcert -- Verifying self-signed https certificate
diff --git a/board/common/rootfs/etc/finit.d/enabled/mkcert.conf b/board/common/rootfs/etc/finit.d/enabled/mkcert.conf
new file mode 120000
index 00000000..166f9f03
--- /dev/null
+++ b/board/common/rootfs/etc/finit.d/enabled/mkcert.conf
@@ -0,0 +1 @@
+../available/mkcert.conf
\ No newline at end of file
diff --git a/board/common/rootfs/etc/mkcert.conf b/board/common/rootfs/etc/mkcert.conf
new file mode 100644
index 00000000..f8df82fb
--- /dev/null
+++ b/board/common/rootfs/etc/mkcert.conf
@@ -0,0 +1,6 @@
+# Sourced by mkcert at boot
+country=SE
+state=Vastmanland
+city=Vasteras
+org=KernelKit
+unit=Infix
diff --git a/board/common/rootfs/sbin/mkcert b/board/common/rootfs/sbin/mkcert
new file mode 100755
index 00000000..ed108b1e
--- /dev/null
+++ b/board/common/rootfs/sbin/mkcert
@@ -0,0 +1,42 @@
+#!/bin/sh
+
+KEY=/cfg/ssl/private/self-signed.key
+CRT=/cfg/ssl/certs/self-signed.crt
+
+country=US
+state=California
+city=Berkeley
+org="Acme, Inc."
+unit=Second
+
+if [ -f /etc/mkcert.conf ]; then
+     . /etc/mkcert.conf
+fi
+
+if [ -z "$cn" ]; then
+    cn=$1
+    if [ -z "$cn" ]; then
+	cn=$(hostname).local
+    fi
+fi
+
+generate()
+{
+    mkdir -p  /cfg/ssl/private /cfg/ssl/certs
+    chmod 700 /cfg/ssl/private
+
+    gencert --country "$country" --state "$state" --city "$city" --organisation "$org" \
+	    --organisation-unit "$unit" --common-name "$cn" \
+	    --out-certificate $CRT --out-key $KEY
+}
+
+CN=$(openssl x509 -noout -subject -in "${CRT}" 2>/dev/null |sed 's/.*CN = //')
+if [ -z "$CN" ] || [ "$CN" != "$cn" ]; then
+    generate "$cn"
+fi
+
+cp "${KEY}" "/etc/ssl/private/"
+cp "${CRT}" "/etc/ssl/certs/"
+initctl cond set mkcert
+
+exit 0