diff --git a/daemon.conf b/daemon.conf
index 9cf670f..524b501 100644
--- a/daemon.conf
+++ b/daemon.conf
@@ -4,4 +4,7 @@ DB_NAME=yp3
 DB_USER=yourpart
 DB_PASSWORD=hitomisan
 THREAD_COUNT=4
-WEBSOCKET_PORT=4551
\ No newline at end of file
+WEBSOCKET_PORT=4551
+WEBSOCKET_SSL_ENABLED=false
+WEBSOCKET_SSL_CERT_PATH=/etc/yourpart/server.crt
+WEBSOCKET_SSL_KEY_PATH=/etc/yourpart/server.key
\ No newline at end of file
diff --git a/setup-ssl.sh b/setup-ssl.sh
new file mode 100755
index 0000000..5b74dc6
--- /dev/null
+++ b/setup-ssl.sh
@@ -0,0 +1,112 @@
+#!/bin/bash
+
+# SSL/TLS Setup Script für YourPart Daemon
+# Erstellt oder verwaltet SSL-Zertifikate für WebSocket Secure (WSS)
+
+set -e
+
+# Farben für Logging
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m' # No Color
+
+log_info() {
+    echo -e "${BLUE}[INFO]${NC} $1"
+}
+
+log_success() {
+    echo -e "${GREEN}[SUCCESS]${NC} $1"
+}
+
+log_warning() {
+    echo -e "${YELLOW}[WARNING]${NC} $1"
+}
+
+log_error() {
+    echo -e "${RED}[ERROR]${NC} $1"
+}
+
+CERT_DIR="/etc/yourpart"
+CERT_FILE="$CERT_DIR/server.crt"
+KEY_FILE="$CERT_DIR/server.key"
+CSR_FILE="$CERT_DIR/server.csr"
+
+# Prüfe ob OpenSSL installiert ist
+if ! command -v openssl &> /dev/null; then
+    log_error "OpenSSL ist nicht installiert!"
+    exit 1
+fi
+
+log_info "SSL/TLS Setup für YourPart Daemon"
+
+# Erstelle Zertifikats-Verzeichnis falls nicht vorhanden
+if [ ! -d "$CERT_DIR" ]; then
+    log_info "Erstelle Zertifikats-Verzeichnis: $CERT_DIR"
+    sudo mkdir -p "$CERT_DIR"
+fi
+
+# Prüfe ob bereits Zertifikate existieren
+if [ -f "$CERT_FILE" ] && [ -f "$KEY_FILE" ]; then
+    log_info "Zertifikate existieren bereits"
+    
+    # Prüfe Gültigkeit der Zertifikate
+    if openssl x509 -in "$CERT_FILE" -text -noout &> /dev/null; then
+        log_success "Zertifikat ist gültig"
+        
+        # Zeige Zertifikats-Informationen
+        log_info "Zertifikats-Informationen:"
+        openssl x509 -in "$CERT_FILE" -text -noout | grep -E "(Subject:|Not Before|Not After|DNS:)"
+        
+        read -p "Möchten Sie neue Zertifikate erstellen? (y/N): " -n 1 -r
+        echo
+        if [[ ! $REPLY =~ ^[Yy]$ ]]; then
+            log_info "Zertifikate bleiben unverändert"
+            exit 0
+        fi
+    else
+        log_warning "Zertifikat ist ungültig, erstelle neue..."
+    fi
+fi
+
+log_info "Erstelle neue SSL-Zertifikate..."
+
+# Erstelle Private Key
+log_info "Erstelle Private Key..."
+sudo openssl genrsa -out "$KEY_FILE" 2048
+sudo chmod 600 "$KEY_FILE"
+sudo chown yourpart:yourpart "$KEY_FILE"
+
+# Erstelle Certificate Signing Request (CSR)
+log_info "Erstelle Certificate Signing Request..."
+sudo openssl req -new -key "$KEY_FILE" -out "$CSR_FILE" -subj "/C=DE/ST=Germany/L=Berlin/O=YourPart/OU=IT/CN=your-part.de"
+
+# Erstelle Self-Signed Certificate
+log_info "Erstelle Self-Signed Certificate..."
+sudo openssl x509 -req -days 365 -in "$CSR_FILE" -signkey "$KEY_FILE" -out "$CERT_FILE"
+
+# Setze korrekte Berechtigungen
+sudo chmod 644 "$CERT_FILE"
+sudo chown yourpart:yourpart "$CERT_FILE"
+
+# Lösche CSR-Datei (nicht mehr benötigt)
+sudo rm -f "$CSR_FILE"
+
+log_success "SSL-Zertifikate erfolgreich erstellt!"
+
+# Zeige Zertifikats-Informationen
+log_info "Zertifikats-Informationen:"
+openssl x509 -in "$CERT_FILE" -text -noout | grep -E "(Subject:|Not Before|Not After|DNS:)"
+
+log_info ""
+log_info "Nächste Schritte:"
+log_info "1. Aktiviere SSL in der Konfiguration:"
+log_info "   WEBSOCKET_SSL_ENABLED=true"
+log_info "2. Starte den Daemon neu:"
+log_info "   sudo systemctl restart yourpart-daemon"
+log_info "3. Verbinde dich mit:"
+log_info "   wss://your-part.de:4551"
+log_info ""
+log_warning "Hinweis: Dies ist ein Self-Signed Certificate!"
+log_warning "Für Produktionsumgebungen verwenden Sie Zertifikate von einer vertrauenswürdigen CA."
diff --git a/src/main.cpp b/src/main.cpp
index f2e5330..74085d2 100644
--- a/src/main.cpp
+++ b/src/main.cpp
@@ -46,8 +46,12 @@ int main() {
             10
         );
         int websocketPort = std::stoi(config.get("WEBSOCKET_PORT"));
+        bool sslEnabled = config.get("WEBSOCKET_SSL_ENABLED") == "true";
+        std::string certPath = sslEnabled ? config.get("WEBSOCKET_SSL_CERT_PATH") : "";
+        std::string keyPath = sslEnabled ? config.get("WEBSOCKET_SSL_KEY_PATH") : "";
+        
         MessageBroker broker;
-        WebSocketServer websocketServer(websocketPort, pool, broker);
+        WebSocketServer websocketServer(websocketPort, pool, broker, sslEnabled, certPath, keyPath);
         // Use C++23 features for better performance
         std::vector<std::unique_ptr<Worker>> workers;
         workers.reserve(9); // Pre-allocate for better performance
diff --git a/src/websocket_server.cpp b/src/websocket_server.cpp
index b7f5104..153ce64 100644
--- a/src/websocket_server.cpp
+++ b/src/websocket_server.cpp
@@ -18,8 +18,9 @@ struct lws_protocols WebSocketServer::protocols[] = {
     { nullptr, nullptr, 0, 0 }
 };
 
-WebSocketServer::WebSocketServer(int port, ConnectionPool &pool, MessageBroker &broker)
-    : port(port), pool(pool), broker(broker) {}
+WebSocketServer::WebSocketServer(int port, ConnectionPool &pool, MessageBroker &broker, 
+                               bool useSSL, const std::string& certPath, const std::string& keyPath)
+    : port(port), pool(pool), broker(broker), useSSL(useSSL), certPath(certPath), keyPath(keyPath) {}
 
 WebSocketServer::~WebSocketServer() {
     stop();
@@ -57,8 +58,21 @@ void WebSocketServer::startServer() {
     info.port = port;
     info.protocols = protocols;
     
+    // SSL/TLS Konfiguration
+    if (useSSL) {
+        if (certPath.empty() || keyPath.empty()) {
+            throw std::runtime_error("SSL enabled but certificate or key path not provided");
+        }
+        info.options = LWS_SERVER_OPTION_DO_SSL_GLOBAL_INIT;
+        info.ssl_cert_filepath = certPath.c_str();
+        info.ssl_private_key_filepath = keyPath.c_str();
+        std::cout << "WebSocket SSL Server starting on port " << port << " with certificates: " 
+                  << certPath << " / " << keyPath << std::endl;
+    } else {
+        std::cout << "WebSocket Server starting on port " << port << " (no SSL)" << std::endl;
+    }
+    
     // Reduziere Log-Level um weniger Debug-Ausgaben zu haben
-    // Setze Umgebungsvariable für Log-Level
     setenv("LWS_LOG_LEVEL", "0", 1);  // 0 = nur Fehler
     
     context = lws_create_context(&info);
diff --git a/src/websocket_server.h b/src/websocket_server.h
index 079770e..f2a4189 100644
--- a/src/websocket_server.h
+++ b/src/websocket_server.h
@@ -25,7 +25,8 @@ class Worker; // forward
 
 class WebSocketServer {
 public:
-    WebSocketServer(int port, ConnectionPool &pool, MessageBroker &broker);
+    WebSocketServer(int port, ConnectionPool &pool, MessageBroker &broker, 
+                   bool useSSL = false, const std::string& certPath = "", const std::string& keyPath = "");
     ~WebSocketServer();
 
     void run();
@@ -46,6 +47,9 @@ private:
     int port;
     ConnectionPool &pool;
     MessageBroker &broker;
+    bool useSSL;
+    std::string certPath;
+    std::string keyPath;
 
     std::atomic<bool> running{false};
     struct lws_context *context = nullptr;