diff --git a/src/sys/svc/hasp_ota.cpp b/src/sys/svc/hasp_ota.cpp
index 9e82b11e..fd113e26 100644
--- a/src/sys/svc/hasp_ota.cpp
+++ b/src/sys/svc/hasp_ota.cpp
@@ -15,14 +15,48 @@
 #include <ESP8266HTTPClient.h>
 #include <ESP8266httpUpdate.h>
 #include <ESP8266WiFi.h>
-#else
+#include <ArduinoOTA.h>
+#endif
+
+#if defined(ARDUINO_ARCH_ESP32)
 #include <HTTPClient.h>
 #include <HTTPUpdate.h>
 #include <WiFi.h>
-#endif
-
 #include <ArduinoOTA.h>
 
+/**
+ * This is lets-encrypt-x3-cross-signed.pem
+ */
+const char* rootCACertificate = "-----BEGIN CERTIFICATE-----\n"
+                                "MIIEkjCCA3qgAwIBAgIQCgFBQgAAAVOFc2oLheynCDANBgkqhkiG9w0BAQsFADA/\n"
+                                "MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT\n"
+                                "DkRTVCBSb290IENBIFgzMB4XDTE2MDMxNzE2NDA0NloXDTIxMDMxNzE2NDA0Nlow\n"
+                                "SjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxIzAhBgNVBAMT\n"
+                                "GkxldCdzIEVuY3J5cHQgQXV0aG9yaXR5IFgzMIIBIjANBgkqhkiG9w0BAQEFAAOC\n"
+                                "AQ8AMIIBCgKCAQEAnNMM8FrlLke3cl03g7NoYzDq1zUmGSXhvb418XCSL7e4S0EF\n"
+                                "q6meNQhY7LEqxGiHC6PjdeTm86dicbp5gWAf15Gan/PQeGdxyGkOlZHP/uaZ6WA8\n"
+                                "SMx+yk13EiSdRxta67nsHjcAHJyse6cF6s5K671B5TaYucv9bTyWaN8jKkKQDIZ0\n"
+                                "Z8h/pZq4UmEUEz9l6YKHy9v6Dlb2honzhT+Xhq+w3Brvaw2VFn3EK6BlspkENnWA\n"
+                                "a6xK8xuQSXgvopZPKiAlKQTGdMDQMc2PMTiVFrqoM7hD8bEfwzB/onkxEz0tNvjj\n"
+                                "/PIzark5McWvxI0NHWQWM6r6hCm21AvA2H3DkwIDAQABo4IBfTCCAXkwEgYDVR0T\n"
+                                "AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwfwYIKwYBBQUHAQEEczBxMDIG\n"
+                                "CCsGAQUFBzABhiZodHRwOi8vaXNyZy50cnVzdGlkLm9jc3AuaWRlbnRydXN0LmNv\n"
+                                "bTA7BggrBgEFBQcwAoYvaHR0cDovL2FwcHMuaWRlbnRydXN0LmNvbS9yb290cy9k\n"
+                                "c3Ryb290Y2F4My5wN2MwHwYDVR0jBBgwFoAUxKexpHsscfrb4UuQdf/EFWCFiRAw\n"
+                                "VAYDVR0gBE0wSzAIBgZngQwBAgEwPwYLKwYBBAGC3xMBAQEwMDAuBggrBgEFBQcC\n"
+                                "ARYiaHR0cDovL2Nwcy5yb290LXgxLmxldHNlbmNyeXB0Lm9yZzA8BgNVHR8ENTAz\n"
+                                "MDGgL6AthitodHRwOi8vY3JsLmlkZW50cnVzdC5jb20vRFNUUk9PVENBWDNDUkwu\n"
+                                "Y3JsMB0GA1UdDgQWBBSoSmpjBH3duubRObemRWXv86jsoTANBgkqhkiG9w0BAQsF\n"
+                                "AAOCAQEA3TPXEfNjWDjdGBX7CVW+dla5cEilaUcne8IkCJLxWh9KEik3JHRRHGJo\n"
+                                "uM2VcGfl96S8TihRzZvoroed6ti6WqEBmtzw3Wodatg+VyOeph4EYpr/1wXKtx8/\n"
+                                "wApIvJSwtmVi4MFU5aMqrSDE6ea73Mj2tcMyo5jMd6jmeWUHK8so/joWUoHOUgwu\n"
+                                "X4Po1QYz+3dszkDqMp4fklxBwXRsW10KXzPMTZ+sOPAveyxindmjkW8lGy+QsRlG\n"
+                                "PfZ+G6Z6h7mjem0Y+iWlkYcV4PIWL1iwBi8saCbGS5jN2p8M+X+Q7UNKEkROb3N6\n"
+                                "KOqkqm57TH2H3eDJAkSnh6/DNFu0Qg==\n"
+                                "-----END CERTIFICATE-----\n";
+
+#endif
+
 static WiFiClient otaClient;
 std::string otaUrl           = "http://ota.netwize.be";
 int16_t otaPort              = HASP_OTA_PORT;
@@ -188,13 +222,21 @@ void otaHttpUpdate(const char* espOtaUrl)
     // ESPhttpUpdate.onProgress(update_progress);
     // ESPhttpUpdate.onError(update_error);
     ESP8266HTTPUpdate httpUpdate;
-#else
-    HTTPUpdate httpUpdate;
-#endif
-
     httpUpdate.rebootOnUpdate(false); // We do that ourselves
     t_httpUpdate_return returnCode = httpUpdate.update(otaClient, espOtaUrl);
 
+#else
+    HTTPUpdate httpUpdate;
+    WiFiClientSecure secClient;
+    secClient.setCACert(rootCACertificate);
+
+    // Reading data over SSL may be slow, use an adequate timeout
+    secClient.setTimeout(12000 / 1000); // timeout argument is defined in seconds for setTimeout
+    httpUpdate.rebootOnUpdate(false);   // We do that ourselves
+    t_httpUpdate_return returnCode = httpUpdate.update(secClient, espOtaUrl);
+
+#endif
+
     switch(returnCode) {
         case HTTP_UPDATE_FAILED:
             LOG_ERROR(TAG_FWUP, F("HTTP_UPDATE_FAILED error %i %s"), httpUpdate.getLastError(),