diff --git a/apps/postgres/certs.yaml b/apps/postgres/certs.yaml
index 350f750..fee13bf 100644
--- a/apps/postgres/certs.yaml
+++ b/apps/postgres/certs.yaml
@@ -1,9 +1,39 @@
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
-  name: postgres-cluster-ca
+  name: postgres-ca
+  namespace: postgres
 spec:
-  secretName: postgres-cluster-ca
+  isCA: true
+  secretTemplate:
+    labels:
+      cnpg.io/reload: ""
+  commonName: postgres-ca
+  secretName: postgres-ca
+  privateKey:
+    algorithm: ECDSA
+    size: 256
+  issuerRef:
+    name: selfsigned
+    kind: ClusterIssuer
+    group: cert-manager.io
+---
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: postgres-ca
+  namespace: postgres
+spec:
+  ca:
+    secretName: postgres-ca
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: postgres-replication-cert
+  namespace: postgres
+spec:
+  secretName: postgres-replication-cert
   secretTemplate:
     labels:
       cnpg.io/reload: ""
@@ -11,6 +41,6 @@ spec:
     - client auth
   commonName: streaming_replica
   issuerRef:
-    name: selfsigned
-    kind: ClusterIssuer
+    name: postgres-ca
+    kind: Issuer
     group: cert-manager.io
diff --git a/apps/postgres/cluster.yaml b/apps/postgres/cluster.yaml
index 76d1c18..6daa0bc 100644
--- a/apps/postgres/cluster.yaml
+++ b/apps/postgres/cluster.yaml
@@ -10,8 +10,8 @@ spec:
     size: 10Gi
 
   certificates:
-    clientCASecret: postgres-cert-ca
-    replicationTLSSecret: postgres-cert-ca
+    clientCASecret: postgres-ca
+    replicationTLSSecret: postgres-replication-cert
 
   # this is here because no `Role` crd exsists yet.
   # see https://github.com/cloudnative-pg/cloudnative-pg/issues/5341