diff --git a/package/confd/confd.mk b/package/confd/confd.mk
index e01756ca..4350985a 100644
--- a/package/confd/confd.mk
+++ b/package/confd/confd.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-CONFD_VERSION = 1.7
+CONFD_VERSION = 1.8
 CONFD_SITE_METHOD = local
 CONFD_SITE = $(BR2_EXTERNAL_INFIX_PATH)/src/confd
 CONFD_LICENSE = BSD-3-Clause
diff --git a/src/confd/configure.ac b/src/confd/configure.ac
index 59e86aee..f52e683f 100644
--- a/src/confd/configure.ac
+++ b/src/confd/configure.ac
@@ -1,6 +1,6 @@
 AC_PREREQ(2.61)
 # confd version is same as system YANG model version, step on breaking changes
-AC_INIT([confd], [1.7], [https://github.com/kernelkit/infix/issues])
+AC_INIT([confd], [1.8], [https://github.com/kernelkit/infix/issues])
 AM_INIT_AUTOMAKE(1.11 foreign subdir-objects)
 AM_SILENT_RULES(yes)
 
@@ -21,6 +21,7 @@ AC_CONFIG_FILES([
 	share/migrate/1.5/Makefile
 	share/migrate/1.6/Makefile
 	share/migrate/1.7/Makefile
+	share/migrate/1.8/Makefile
 	yang/Makefile
 	yang/confd/Makefile
 	yang/test-mode/Makefile
diff --git a/src/confd/share/migrate/1.8/10-keystore-add-gencert.sh b/src/confd/share/migrate/1.8/10-keystore-add-gencert.sh
new file mode 100755
index 00000000..7afea14f
--- /dev/null
+++ b/src/confd/share/migrate/1.8/10-keystore-add-gencert.sh
@@ -0,0 +1,89 @@
+#!/bin/sh
+# Migrate self-signed HTTPS certificate from /cfg/ssl/ files into the
+# ietf-keystore in startup-config.  Previously mkcert generated cert
+# and key files on disk; now they are managed as a keystore entry
+# called "gencert" alongside the SSH "genkey" entry.
+#
+# Also adds the "certificate": "gencert" leaf to the web container
+# so nginx knows which keystore entry to use for TLS.
+#
+# After migration, /cfg/ssl/ is removed since cert/key are now stored
+# in the keystore and written to /etc/ssl/ by confd at runtime.
+
+file=$1
+temp=${file}.tmp
+
+LEGACY_DIR=/cfg/ssl
+LEGACY_KEY=$LEGACY_DIR/private/self-signed.key
+LEGACY_CRT=$LEGACY_DIR/certs/self-signed.crt
+
+MKCERT_DIR=/tmp/ssl
+MKCERT_KEY=$MKCERT_DIR/self-signed.key
+MKCERT_CRT=$MKCERT_DIR/self-signed.crt
+
+# Read PEM files, strip markers and newlines to get raw base64
+read_pem() {
+    grep -v -- '-----' "$1" | tr -d '\n'
+}
+
+if [ -f "$LEGACY_KEY" ] && [ -f "$LEGACY_CRT" ]; then
+    priv_key=$(read_pem "$LEGACY_KEY")
+    cert_data=$(read_pem "$LEGACY_CRT")
+fi
+
+# Fallback: generate a fresh certificate if legacy files were missing
+# or unreadable, same as keystore.c does on first boot.
+if [ -z "$priv_key" ] || [ -z "$cert_data" ]; then
+    /usr/libexec/infix/mkcert
+    if [ -f "$MKCERT_KEY" ] && [ -f "$MKCERT_CRT" ]; then
+        priv_key=$(read_pem "$MKCERT_KEY")
+        cert_data=$(read_pem "$MKCERT_CRT")
+        rm -rf "$MKCERT_DIR"
+    fi
+fi
+
+# If we still have no cert data, leave keys empty and let confd
+# generate on boot via keystore_update().
+if [ -z "$priv_key" ]; then
+    priv_key=""
+    cert_data=""
+fi
+
+jq --arg priv "$priv_key" --arg cert "$cert_data" '
+# Add gencert entry to keystore if not already present
+if .["ietf-keystore:keystore"]?."asymmetric-keys"?."asymmetric-key" then
+  if (.["ietf-keystore:keystore"]."asymmetric-keys"."asymmetric-key" | map(select(.name == "gencert")) | length) == 0 then
+    .["ietf-keystore:keystore"]."asymmetric-keys"."asymmetric-key" += [{
+      "name": "gencert",
+      "public-key-format": "infix-crypto-types:x509-public-key-format",
+      "public-key": $cert,
+      "private-key-format": "infix-crypto-types:rsa-private-key-format",
+      "cleartext-private-key": $priv,
+      "certificates": {
+        "certificate": [{
+          "name": "self-signed",
+          "cert-data": $cert
+        }]
+      }
+    }]
+  else
+    .
+  end
+else
+  .
+end |
+
+# Add certificate reference to web container
+if .["infix-services:web"] then
+  if .["infix-services:web"].certificate then
+    .
+  else
+    .["infix-services:web"].certificate = "gencert"
+  end
+else
+  .
+end
+' "$file" > "$temp" && mv "$temp" "$file"
+
+# Cert/key now live in the keystore, wipe the legacy on-disk copy
+rm -rf "$LEGACY_DIR"
diff --git a/src/confd/share/migrate/1.8/Makefile.am b/src/confd/share/migrate/1.8/Makefile.am
new file mode 100644
index 00000000..5586bceb
--- /dev/null
+++ b/src/confd/share/migrate/1.8/Makefile.am
@@ -0,0 +1,2 @@
+migratedir          = $(pkgdatadir)/migrate/1.8
+dist_migrate_DATA   = 10-keystore-add-gencert.sh
diff --git a/src/confd/share/migrate/Makefile.am b/src/confd/share/migrate/Makefile.am
index 0a7c2c82..0a5c71dd 100644
--- a/src/confd/share/migrate/Makefile.am
+++ b/src/confd/share/migrate/Makefile.am
@@ -1,2 +1,2 @@
-SUBDIRS             = 1.0 1.1 1.2 1.3 1.4 1.5 1.6 1.7
+SUBDIRS             = 1.0 1.1 1.2 1.3 1.4 1.5 1.6 1.7 1.8
 migratedir          = $(pkgdatadir)/migrate