diff --git a/ansible/deploy_home.yml b/ansible/deploy_home.yml
index 40758a2..b2a9f26 100644
--- a/ansible/deploy_home.yml
+++ b/ansible/deploy_home.yml
@@ -4,5 +4,6 @@
   - vars/vault.yml
   roles:
   - role: common
+  - role: ssl
   - role: http
   - role: drone
diff --git a/ansible/roles/http/meta/main.yml b/ansible/roles/http/meta/main.yml
index fdda41b..bfe9e18 100644
--- a/ansible/roles/http/meta/main.yml
+++ b/ansible/roles/http/meta/main.yml
@@ -1,3 +1,3 @@
 ---
 dependencies:
-  - role: common
+  - role: ssl
diff --git a/ansible/roles/http/tasks/https.yml b/ansible/roles/http/tasks/https.yml
new file mode 100644
index 0000000..d332778
--- /dev/null
+++ b/ansible/roles/http/tasks/https.yml
@@ -0,0 +1,23 @@
+---
+
+- name: template nginx https sites-available
+  become: true
+  template:
+    src: "templates/nginx/sites/{{ item }}.j2"
+    dest: "/etc/nginx/sites-available/{{ item }}"
+    mode: 0644
+  with_items:
+    - "{{ ci_server_name }}.https.conf"
+  tags: https
+
+- name: enable desired nginx https sites
+  become: true
+  file:
+    src: "/etc/nginx/sites-available/{{ item }}"
+    dest: "/etc/nginx/sites-enabled/{{ item }}"
+    state: link
+  with_items:
+    - "{{ ci_server_name }}.https.conf"
+  notify: restart_nginx
+  when: stat_result.stat.exists
+  tags: https
diff --git a/ansible/roles/http/tasks/main.yml b/ansible/roles/http/tasks/main.yml
index 8f657d3..68ecafb 100644
--- a/ansible/roles/http/tasks/main.yml
+++ b/ansible/roles/http/tasks/main.yml
@@ -2,5 +2,4 @@
 - import_tasks: deps.yml
 - import_tasks: modsec.yml
 - import_tasks: http.yml
-- import_tasks: ssl.yml
-- import_tasks: cron.yml
+- import_tasks: https.yml
diff --git a/ansible/roles/http/tasks/ssl.yml b/ansible/roles/http/tasks/ssl.yml
deleted file mode 100644
index e5eda28..0000000
--- a/ansible/roles/http/tasks/ssl.yml
+++ /dev/null
@@ -1,60 +0,0 @@
----
-- name: flush existing nginx https enabled sites
-  become: true
-  file:
-    path: "/etc/nginx/sites-enabled/{{ item }}"
-    state: absent
-  with_items:
-    - "{{ ci_server_name }}.https.conf"
-  notify: restart_nginx
-  tags: ssl
-
-- meta: flush_handlers
-  tags: ssl
-
-- name: generate openssl dhparam for nginx
-  become: true
-  command: |
-    openssl dhparam -dsaparam -out /etc/ssl/certs/dhparam.pem 2048
-  args:
-    creates: /etc/ssl/certs/dhparam.pem
-  tags: ssl
-
-- name: create ssl certificate for ci server
-  become: true
-  command: |
-    certbot certonly --webroot --webroot-path=/srv/http \
-    -m {{ ci_server_email }} --agree-tos \
-    -d {{ ci_server_name }}
-  args:
-    creates: "/etc/letsencrypt/live/{{ ci_server_name }}"
-  tags: ssl
-
-- name: check if certbot certificate was created
-  become: true
-  stat:
-    path: "/etc/letsencrypt/live/{{ ci_server_name }}"
-  register: stat_result
-  tags: ssl
-
-- name: template nginx https sites-available
-  become: true
-  template:
-    src: "templates/nginx/sites/{{ item }}.j2"
-    dest: "/etc/nginx/sites-available/{{ item }}"
-    mode: 0644
-  with_items:
-    - "{{ ci_server_name }}.https.conf"
-  tags: ssl
-
-- name: enable desired nginx https sites
-  become: true
-  file:
-    src: "/etc/nginx/sites-available/{{ item }}"
-    dest: "/etc/nginx/sites-enabled/{{ item }}"
-    state: link
-  with_items:
-    - "{{ ci_server_name }}.https.conf"
-  notify: restart_nginx
-  when: stat_result.stat.exists
-  tags: ssl
diff --git a/ansible/roles/ssl/meta/main.yml b/ansible/roles/ssl/meta/main.yml
new file mode 100644
index 0000000..fdda41b
--- /dev/null
+++ b/ansible/roles/ssl/meta/main.yml
@@ -0,0 +1,3 @@
+---
+dependencies:
+  - role: common
diff --git a/ansible/roles/ssl/tasks/certbot.yml b/ansible/roles/ssl/tasks/certbot.yml
new file mode 100644
index 0000000..fa67f71
--- /dev/null
+++ b/ansible/roles/ssl/tasks/certbot.yml
@@ -0,0 +1,25 @@
+---
+- name: generate openssl dhparam for nginx
+  become: true
+  command: |
+    openssl dhparam -dsaparam -out /etc/ssl/certs/dhparam.pem 2048
+  args:
+    creates: /etc/ssl/certs/dhparam.pem
+  tags: ssl
+
+- name: create ssl certificate for ci server
+  become: true
+  command: |
+    certbot certonly --webroot --webroot-path=/srv/http \
+    -m {{ ci_server_email }} --agree-tos \
+    -d {{ ci_server_name }}
+  args:
+    creates: "/etc/letsencrypt/live/{{ ci_server_name }}"
+  tags: ssl
+
+- name: check if certbot certificate was created
+  become: true
+  stat:
+    path: "/etc/letsencrypt/live/{{ ci_server_name }}"
+  register: stat_result
+  tags: ssl
diff --git a/ansible/roles/http/tasks/cron.yml b/ansible/roles/ssl/tasks/cron.yml
similarity index 100%
rename from ansible/roles/http/tasks/cron.yml
rename to ansible/roles/ssl/tasks/cron.yml
diff --git a/ansible/roles/ssl/tasks/main.yml b/ansible/roles/ssl/tasks/main.yml
new file mode 100644
index 0000000..a27991f
--- /dev/null
+++ b/ansible/roles/ssl/tasks/main.yml
@@ -0,0 +1,3 @@
+---
+- import_tasks: certbot.yml
+- import_tasks: cron.yml