diff --git a/docker-compose.yml b/docker-compose.yml
index a226e2f..21f55e5 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -18,6 +18,7 @@ services:
     volumes:
       - ./data:/var/mail
       - ./config:/tmp/docker-mailserver
+      - ./ssl:/etc/letsencrypt:ro
       # Если есть свои сертификаты:
       # - ./ssl/fullchain.pem:/etc/ssl/certs/ssl-cert-snakeoil.pem:ro
       # - ./ssl/privkey.pem:/etc/ssl/private/ssl-cert-snakeoil.key:ro
diff --git a/mailserver.env b/mailserver.env
index 3d84353..782017d 100644
--- a/mailserver.env
+++ b/mailserver.env
@@ -7,3 +7,6 @@ ENABLE_CLAMAV=1
 ENABLE_FAIL2BAN=1
 ONE_DIR=1
 DMS_DEBUG=0
+SSL_TYPE=manual
+SSL_CERT_PATH=/etc/letsencrypt/live/mail.crabs-games.art/fullchain.pem
+SSL_KEY_PATH=/etc/letsencrypt/live/mail.crabs-games.art/privkey.pem
diff --git a/setup-mail-tls.sh b/setup-mail-tls.sh
new file mode 100755
index 0000000..bc93233
--- /dev/null
+++ b/setup-mail-tls.sh
@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+DOMAIN="${MAIL_DOMAIN:-mail.crabs-games.art}"
+EMAIL="${ACME_EMAIL:-admin@crabs-games.art}"
+REPROXY_CONTAINER="${REPROXY_CONTAINER:-reproxy}"
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+SSL_DIR="$SCRIPT_DIR/ssl"
+COMPOSE_FILE="$SCRIPT_DIR/docker-compose.yml"
+
+command -v docker >/dev/null || { echo "docker is required" >&2; exit 1; }
+docker info >/dev/null || { echo "docker access is required" >&2; exit 1; }
+
+mkdir -p "$SSL_DIR"
+
+reproxy_was_running=0
+if docker inspect -f '{{.State.Running}}' "$REPROXY_CONTAINER" 2>/dev/null | grep -qx true; then
+  reproxy_was_running=1
+  docker stop "$REPROXY_CONTAINER" >/dev/null
+fi
+
+restart_reproxy() {
+  if [ "$reproxy_was_running" -eq 1 ]; then
+    docker start "$REPROXY_CONTAINER" >/dev/null
+  fi
+}
+trap restart_reproxy EXIT
+
+docker run --rm \
+  -p 80:80 \
+  -v "$SSL_DIR:/etc/letsencrypt" \
+  certbot/certbot:latest \
+  certonly --standalone \
+  --keep-until-expiring \
+  --non-interactive \
+  --agree-tos \
+  --email "$EMAIL" \
+  -d "$DOMAIN"
+
+docker compose -f "$COMPOSE_FILE" up -d --force-recreate mailserver
+
+echo "TLS certificate for $DOMAIN is installed."
+echo "Check it with: openssl s_client -connect $DOMAIN:465 -servername $DOMAIN </dev/null 2>/dev/null | openssl x509 -noout -dates"