diff --git a/inventory/hosts.yaml b/inventory/hosts.yaml
index c9a3be0..f70cf6e 100644
--- a/inventory/hosts.yaml
+++ b/inventory/hosts.yaml
@@ -39,3 +39,11 @@ all:
           ansible_become_password: "{{ ansible_become_passwd }}"
           services_to_run:
             - coder_ai
+    web-servers:
+      hosts:
+        cert-proxy:
+          ansible_host: 192.168.0.47
+          ansible_become_password: "{{ ansible_become_passwd }}"
+        monitoring:
+          ansible_host: 192.168.0.49
+          ansible_become_password: "{{ ansible_become_passwd }}"
diff --git a/playbooks/maintain.yaml b/playbooks/maintain.yaml
index 9270457..b0d2c71 100644
--- a/playbooks/maintain.yaml
+++ b/playbooks/maintain.yaml
@@ -1,5 +1,5 @@
 ---
-- name: Deploy and set up an LXC container in Proxmox
+- name: Perform regular maintenance
   hosts: virtual
   remote_user: ansible
   
@@ -20,3 +20,14 @@
     - ../roles/update_configs
     # Make sure that the services that are supposed to run are running
     - ../roles/check_services
+
+- name: Ensure all web-servers have fresh TLS certificates
+  hosts: web-servers
+  remote_user: ansible
+  
+  vars_files:
+    ../inventory/group_vars/all/secrets.yaml
+  
+  roles:
+    # Pull certificates from cert_proxy and distribute them among the servers
+    - ../roles/update_certificates
diff --git a/roles/update_certificates/tasks/main.yaml b/roles/update_certificates/tasks/main.yaml
new file mode 100644
index 0000000..dfb18f9
--- /dev/null
+++ b/roles/update_certificates/tasks/main.yaml
@@ -0,0 +1,23 @@
+---
+- name: Pull directory from remote host to control node
+  ansible.posix.synchronize:
+    mode: pull
+    src: /tmp/letsencrypt
+    dest: /tmp 
+    recursive: true
+    delete: true
+  when: "inventory_hostname == 'cert-proxy'"
+
+- name: Push loki.vmn.su certificate to the target
+  ansible.builtin.copy:
+    src: /tmp/letsencrypt/live/loki.vmn.su/fullchain.pem
+    dest: /etc/nginx/certs/loki_fullchain.pem
+    local_follow: true
+  when: "inventory_hostname == 'monitoring'"
+
+- name: Push loki.vmn.su key to the target
+  ansible.builtin.copy:
+    src: /tmp/letsencrypt/live/loki.vmn.su/privkey.pem
+    dest: /etc/nginx/certs/loki_privkey.pem
+    local_follow: true
+  when: "inventory_hostname == 'monitoring'"