diff --git a/defaults/main.yml b/defaults/main.yml
index fe8365c..71bb5cc 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -41,3 +41,13 @@ rocket_chat_nginx_generate_pfs_key: true
 rocket_chat_nginx_pfs_key_numbits: 2048
 rocket_chat_nginx_pfs_key_path: /etc/nginx/rocket_chat.pem
 rocket_chat_nginx_pfs_file: ~
+
+# letsencrypt settings
+rocket_chat_include_letsencrypt: false
+rocket_chat_letsencrypt_email: ~
+rocket_chat_letsencrypt_account_key: /etc/nginx/acme-tiny_account.key
+rocket_chat_letsencrypt_csr: /etc/nginx/acme-tiny_{{ rocket_chat_service_host }}.csr
+rocket_chat_letsencrypt_domain: "{{ rocket_chat_service_host }}"
+rocket_chat_letsencrypt_acmetiny_path: /opt/acme-tiny
+rocket_chat_letsencrypt_wellknown_path: /var/www/letsencrypt
+rocket_chat_letsencrypt_ca_cert: https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem
diff --git a/tasks/letsencrypt.yml b/tasks/letsencrypt.yml
new file mode 100644
index 0000000..ce089b2
--- /dev/null
+++ b/tasks/letsencrypt.yml
@@ -0,0 +1,56 @@
+---
+
+# possibly just copy the script into files and include it w/ the role?
+- name: Clone acme-tiny to /opt [Let's Encrypt!]
+  git:
+    dest: "{{ rocket_chat_letsencrypt_acmetiny_path }}"
+    repo: https://github.com/diafygi/acme-tiny.git
+    force: yes
+    update: yes
+
+- name: Ensure letsencrypt well-known dir exists [Let's Encrypt!]
+  file:
+    path: "{{ rocket_chat_letsencrypt_wellknown_path  }}"
+    state: directory
+    owner: "{{ rocket_chat_nginx_process_user }}"
+
+- name: Generate acme-tiny Let's Encrypt account key [Let's Encrypt!]
+  shell: >-
+    openssl genrsa -out {{ rocket_chat_letsencrypt_account_key }} 4096
+  args:
+    creates: "{{ rocket_chat_letsencrypt_account_key }}"
+
+- name: Check if acme-tiny Let's Encrypt CSR exists [Let's Encrypt!]
+  stat:
+    path: "{{ rocket_chat_letsencrypt_csr }}"
+  register: csr_path
+
+- name: Generate acme-tiny Let's Encrypt CSR [Let's Encrypt!]
+  shell: >-
+    openssl req -new -sha256 -key {{ rocket_chat_ssl_key_path }}
+    -subj "/CN={{ rocket_chat_letsencrypt_domain | default(rocket_chat_service_host) }}"
+    -out {{ rocket_chat_letsencrypt_csr }}
+  when:
+    - (key_gen_result | changed) or
+      not csr_path.stat.exists
+  register: csr_gen_result
+
+- name: Setup script in cron.daily [Let's Encrypt!]
+  copy:
+    dest: /etc/cron.monthly/acme-tiny_renew.sh
+    mode: 0755
+    content: |
+      #!/bin/bash
+      python {{ rocket_chat_letsencrypt_acmetiny_path }}/acme_tiny.py \
+      --account-key {{ rocket_chat_letsencrypt_account_key }}  \
+      --csr {{ rocket_chat_letsencrypt_csr }}  \
+      --acme-dir {{ rocket_chat_letsencrypt_wellknown_path  }} \
+      > {{ rocket_chat_ssl_cert_path }} || exit
+      curl -s {{ rocket_chat_letsencrypt_ca_cert }} \
+      >> {{ rocket_chat_ssl_cert_path }} &&
+      nginx -t && nginx -s reload
+
+- name: Run acme-tiny_renew.sh (first run cert creation) [Let's Encrypt!]
+  shell: /etc/cron.monthly/acme-tiny_renew.sh
+  notify: Reload the Nginx service
+  when: csr_gen_result | changed
diff --git a/tasks/main.yml b/tasks/main.yml
index 1adbfcc..bd395c1 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -207,3 +207,7 @@
   - include: nginx.yml
     when: rocket_chat_include_nginx|bool
     tags: nginx
+
+  - include: letsencrypt.yml
+    when: rocket_chat_include_letsencrypt|bool
+    tags: letsencrypt
diff --git a/tasks/nginx.yml b/tasks/nginx.yml
index 5860a10..defaeeb 100644
--- a/tasks/nginx.yml
+++ b/tasks/nginx.yml
@@ -36,16 +36,19 @@
 
   - name: Ensure SSL certs have been generated
     shell: >-
-      openssl req -x509 -newkey rsa:2048 -nodes
+      openssl req -x509 -newkey rsa:4096 -nodes
       -subj "/CN={{ rocket_chat_service_host }}/
       /C=NA/ST=NA/L=NA/O=NA/OU=NA"
       -keyout {{ rocket_chat_ssl_key_path }}
       -out {{ rocket_chat_ssl_cert_path }}
       -days 3650
-    when: rocket_chat_ssl_generate_certs|bool
+    when:
+      - rocket_chat_include_letsencrypt|bool
+        or rocket_chat_ssl_generate_certs|bool
     args:
       creates: "{{ rocket_chat_ssl_key_path }}"
     notify: Reload the Nginx service
+    register: key_gen_result
 
   - name: Ensure provided PFS key has been deployed
     copy:
diff --git a/templates/rocket_chat.conf.j2 b/templates/rocket_chat.conf.j2
index 8ce677a..5d2e0be 100644
--- a/templates/rocket_chat.conf.j2
+++ b/templates/rocket_chat.conf.j2
@@ -4,10 +4,14 @@ upstream rocket_chat {
 server {
         listen  80;
         server_name  {{ rocket_chat_service_host }};
-
-        # tell users to go to SSL version this time
-        if ($ssl_protocol = "") {
-        rewrite     ^   https://$server_name$request_uri? permanent;
+{% if rocket_chat_include_letsencrypt|bool %}
+        location /.well-known/acme-challenge/ {
+                alias /var/www/letsencrypt/;
+                try_files $uri =404;
+        }
+{% endif %}
+        location / {
+                return 301 https://$host$request_uri;
         }
 }
 
diff --git a/vars/Debian.yml b/vars/Debian.yml
index 79b7159..9ff7861 100644
--- a/vars/Debian.yml
+++ b/vars/Debian.yml
@@ -6,6 +6,8 @@ rocket_chat_dep_packages:
   - npm
   - make
   - wget
+  # This seems to install something on Docker that causes a failure in the tests
+  - cron
 
 rocket_chat_mongodb_packages:
   - mongodb-org-server
diff --git a/vars/RedHat.yml b/vars/RedHat.yml
index 58671eb..7c1de1c 100644
--- a/vars/RedHat.yml
+++ b/vars/RedHat.yml
@@ -6,6 +6,7 @@ rocket_chat_dep_packages:
   - npm
   - make
   - wget
+  - crontabs
 
 rocket_chat_mongodb_packages:
   - mongodb
diff --git a/vars/Ubuntu.yml b/vars/Ubuntu.yml
index 79b7159..d4a44da 100644
--- a/vars/Ubuntu.yml
+++ b/vars/Ubuntu.yml
@@ -6,6 +6,7 @@ rocket_chat_dep_packages:
   - npm
   - make
   - wget
+  - cron
 
 rocket_chat_mongodb_packages:
   - mongodb-org-server