diff --git a/src/Initer.php b/src/Initer.php
index 4139d45..7a1593f 100644
--- a/src/Initer.php
+++ b/src/Initer.php
@@ -28,6 +28,7 @@ class Initer
             'role:unauthorized',
             'role:ticket.user',
             'role:domain.user', 'domain.pay', 'domain.push',
+            'role:certificate.user', 'certificate.pay', 'certificate.push',
             'role:server.user', 'server.pay',
             'role:account.user',
             'bill.read',
@@ -37,6 +38,7 @@ class Initer
             'role:ticket.manager',
             'role:client.support',
             'role:domain.user',
+            'role:certificate.user',
             'role:server.user',
             'role:account.user',
         ],
@@ -48,6 +50,7 @@ class Initer
             'role:support', 'manage',
             'role:document.manager', 'role:stock.manager',
             'role:domain.manager', 'domain.pay', 'domain.push',
+            'role:certificate.manager', 'certificate.pay', 'certificate.push',
             'role:client.manager',
             'bill.read',
             'server.pay', 'server.sell',
@@ -79,6 +82,12 @@ class Initer
             'domain.freeze', 'domain.unfreeze',
             'domain.push', 'domain.force-push',
         ],
+        'role:certificate.user' => [
+            'certificate.read', 'certificate.update',
+        ],
+        'role:certificate.manager' => [
+            'role:certificate.user', 'certificate.delete',
+        ],
         'role:account.user' => [
             'account.read', 'account.create', 'account.update', 'account.delete',
         ],
diff --git a/src/files/items.php b/src/files/items.php
index 75a4d5f..0f3f7e8 100644
--- a/src/files/items.php
+++ b/src/files/items.php
@@ -21,6 +21,9 @@
             'role:domain.user',
             'domain.pay',
             'domain.push',
+            'role:certificate.user',
+            'certificate.pay',
+            'certificate.push',
             'role:server.user',
             'server.pay',
             'role:account.user',
@@ -35,6 +38,7 @@
             'role:ticket.manager',
             'role:client.support',
             'role:domain.user',
+            'role:certificate.user',
             'role:server.user',
             'role:account.user',
         ],
@@ -57,6 +61,9 @@
             'role:domain.manager',
             'domain.pay',
             'domain.push',
+            'role:certificate.manager',
+            'certificate.pay',
+            'certificate.push',
             'role:client.manager',
             'bill.read',
             'server.pay',
@@ -117,6 +124,20 @@
             'domain.force-push',
         ],
     ],
+    'role:certificate.user' => [
+        'type' => 1,
+        'children' => [
+            'certificate.read',
+            'certificate.update',
+        ],
+    ],
+    'role:certificate.manager' => [
+        'type' => 1,
+        'children' => [
+            'role:certificate.user',
+            'certificate.delete',
+        ],
+    ],
     'role:account.user' => [
         'type' => 1,
         'children' => [
@@ -258,6 +279,12 @@
     'domain.push' => [
         'type' => 2,
     ],
+    'certificate.pay' => [
+        'type' => 2,
+    ],
+    'certificate.push' => [
+        'type' => 2,
+    ],
     'server.pay' => [
         'type' => 2,
     ],
@@ -315,6 +342,15 @@
     'domain.force-push' => [
         'type' => 2,
     ],
+    'certificate.read' => [
+        'type' => 2,
+    ],
+    'certificate.update' => [
+        'type' => 2,
+    ],
+    'certificate.delete' => [
+        'type' => 2,
+    ],
     'account.read' => [
         'type' => 2,
     ],
diff --git a/tests/unit/CheckAccessTrait.php b/tests/unit/CheckAccessTrait.php
index 3c2de9d..2e22901 100644
--- a/tests/unit/CheckAccessTrait.php
+++ b/tests/unit/CheckAccessTrait.php
@@ -73,6 +73,7 @@ public function testClient()
             'restore-password', 'deposit',
             'ticket.read', 'ticket.create', 'ticket.answer', 'ticket.close',
             'domain.read', 'domain.update', 'domain.pay', 'domain.push',
+            'certificate.read', 'certificate.update', 'certificate.pay', 'certificate.push',
             'server.read', 'server.pay',
             'account.read', 'account.create', 'account.update', 'account.delete',
             'bill.read',
@@ -86,6 +87,7 @@ public function testSupport()
             'ticket.read', 'ticket.create', 'ticket.answer', 'ticket.close', 'ticket.update', 'ticket.delete',
             'client.read',
             'domain.read', 'domain.update',
+            'certificate.read', 'certificate.update',
             'server.read',
             'account.read', 'account.create', 'account.update', 'account.delete',
         ]);
@@ -98,6 +100,7 @@ public function testAdmin()
             'ticket.read', 'ticket.create', 'ticket.answer', 'ticket.close', 'ticket.update', 'ticket.delete',
             'client.read',
             'domain.read', 'domain.update',
+            'certificate.read', 'certificate.update',
             'server.read', 'server.create', 'server.update', 'server.delete',
             'account.read', 'account.create', 'account.update', 'account.delete',
         ]);
@@ -112,6 +115,7 @@ public function testManager()
             'bill.read',
             'domain.read', 'domain.update', 'domain.delete',
             'domain.pay', 'domain.push',
+            'certificate.read', 'certificate.update', 'certificate.delete', 'certificate.pay', 'certificate.push',
             'server.read', 'server.pay', 'server.sell',
             'account.read', 'account.create', 'account.update', 'account.delete',
             'document.read', 'document.create', 'document.update', 'document.delete', 'document.generate',
@@ -143,6 +147,7 @@ public function testMighty()
             'domain.freeze',
             'domain.read', 'domain.update', 'domain.delete',
             'domain.pay', 'domain.push', 'domain.force-push',
+            'certificate.read', 'certificate.update', 'certificate.delete', 'certificate.pay', 'certificate.push',
             'server.read', 'server.create', 'server.update', 'server.delete', 'server.pay', 'server.sell',
             'account.read', 'account.create', 'account.update', 'account.delete',
             'document.read', 'document.create', 'document.update', 'document.delete',
@@ -163,6 +168,7 @@ public function testDeny()
         $this->assertAccesses('user:limited', [
             'ticket.read', 'ticket.create', 'ticket.answer', 'ticket.close',
             'domain.read', 'domain.update', 'domain.pay',
+            'certificate.read', 'certificate.update', 'certificate.pay', 'certificate.push',
             'account.read', 'account.create', 'account.update', 'account.delete',
             'restore-password', 'bill.read',
         ]);