diff --git a/site-cookbooks/kosmos-dirsrv/resources/instance.rb b/site-cookbooks/kosmos-dirsrv/resources/instance.rb
index 97cd492..0ef689b 100644
--- a/site-cookbooks/kosmos-dirsrv/resources/instance.rb
+++ b/site-cookbooks/kosmos-dirsrv/resources/instance.rb
@@ -129,9 +129,21 @@ nsslapd-allow-anonymous-access: off
       source 'nginx_conf_empty.erb'
       owner node["nginx"]["user"]
       mode 0640
+      notifies :reload, 'service[nginx]', :delayed
     end
 
     nginx_certbot_site new_resource.hostname do
+      notifies :run, "letsencrypt cert for #{domain}", :delayed
+    end
+
+    # Generate a Let's Encrypt cert (only if the nginx vhost exists and no cert
+    # has been generated before. The renew cron will take care of renewing
+    execute "letsencrypt cert for #{domain}" do
+      command "/usr/bin/certbot certonly --webroot --agree-tos --email ops@kosmos.org --webroot-path #{root_directory} --deploy-hook /etc/letsencrypt/renewal-hooks/deploy/dirsrv -d #{domain} -n"
+      only_if do
+        ::File.exist?("#{node['nginx']['dir']}/sites-enabled/#{domain}_certbot") &&
+          !::File.exist?("/etc/letsencrypt/live/#{domain}/fullchain.pem")
+      end
       notifies :run, "execute[add tls config]", :immediately
     end