diff --git a/crmbackend.nginx.conf b/crmbackend.nginx.conf
index 9585ccf..4aafa5c 100644
--- a/crmbackend.nginx.conf
+++ b/crmbackend.nginx.conf
@@ -1,5 +1,4 @@
 server {
-    listen 80;
     server_name betaapicsa.tradhox.com apicsa.tradhox.com;
 
     location / {
@@ -21,4 +20,22 @@ server {
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
     }
+
+    listen 443 ssl; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/betaapicsa.tradhox.com/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/betaapicsa.tradhox.com/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+}
+
+server {
+    if ($host = apicsa.tradhox.com) {
+        return 301 https://$host$request_uri;
+    }
+    if ($host = betaapicsa.tradhox.com) {
+        return 301 https://$host$request_uri;
+    }
+    listen 80;
+    server_name betaapicsa.tradhox.com apicsa.tradhox.com;
+    return 404;
 }