diff --git a/certbot/ns1.staging.grapheneos.org b/certbot/ns1.staging.grapheneos.org
new file mode 100644
index 0000000..6234fcd
--- /dev/null
+++ b/certbot/ns1.staging.grapheneos.org
@@ -0,0 +1,6 @@
+certbot certonly --webroot --webroot-path /srv/certbot --no-eff-email \
+    --key-type ecdsa --reuse-key --must-staple --preferred-chain "ISRG Root X1" \
+    --deploy-hook "certbot-ocsp-fetcher -o /var/cache/certbot-ocsp-fetcher" \
+    --cert-name ns1.staging.grapheneos.org \
+    -d ns1.staging.grapheneos.org \
+    -d ns1.staging.attestation.app