diff --git a/roles/koji_hub/tasks/main.yaml b/roles/koji_hub/tasks/main.yaml
index a2433a4..13af634 100644
--- a/roles/koji_hub/tasks/main.yaml
+++ b/roles/koji_hub/tasks/main.yaml
@@ -125,6 +125,7 @@
     - { src: "kojihub.pem", dest: "/etc/pki/koji/kojihub.pem", mode: "0644", group: "apache" }
     - { src: "kojiadmin.pem", dest: "{{ koji_admin_cert_path }}", mode: "0644" }
     - { src: "kojira.pem", dest: "/etc/pki/koji/kojira.pem", mode: "0640", group: "kojira" }
+    - { src: "kojiweb.pem", dest: "/etc/pki/koji/kojiweb.pem", mode: "0640", group: "apache" }
 
 - name: Update CA trust store
   ansible.builtin.command: update-ca-trust
@@ -195,6 +196,15 @@
     - httpd_use_nfs
   notify: Restart httpd
 
+- name: Configure httpd MaxConnectionsPerChild to prevent memory leaks
+  ansible.builtin.lineinfile:
+    path: /etc/httpd/conf/httpd.conf
+    regexp: '^#?\s*MaxConnectionsPerChild\s+\d+'
+    line: 'MaxConnectionsPerChild 100'
+    state: present
+    backup: true
+  notify: Restart httpd
+
 - name: Start and enable httpd
   ansible.builtin.service:
     name: httpd
diff --git a/roles/koji_hub/templates/koji.conf.j2 b/roles/koji_hub/templates/koji.conf.j2
index a601b70..1ffec6f 100644
--- a/roles/koji_hub/templates/koji.conf.j2
+++ b/roles/koji_hub/templates/koji.conf.j2
@@ -1,7 +1,7 @@
 [koji]
 server = https://{{ koji_hub_fqdn }}/kojihub
-weburl = http://{{ koji_hub_fqdn }}/koji
-topurl = http://{{ koji_hub_fqdn }}/kojifiles
+weburl = https://{{ koji_hub_fqdn }}/koji
+topurl = https://{{ koji_hub_fqdn }}/kojifiles
 topdir = {{ koji_top_dir }}
 cert = ~/.koji/client.pem
 key = /home/{{ koji_admin_user }}/.koji/client.key
diff --git a/roles/koji_hub/templates/web.conf.j2 b/roles/koji_hub/templates/web.conf.j2
index 1a2e0ca..7aaa8ae 100644
--- a/roles/koji_hub/templates/web.conf.j2
+++ b/roles/koji_hub/templates/web.conf.j2
@@ -3,6 +3,7 @@ SiteName = MxOS koji
 KojiHubURL = https://{{ koji_hub_fqdn }}/kojihub
 KojiFilesURL = https://{{ koji_hub_fqdn }}/kojifiles
 WebAuthType = ssl
+WebCert = /etc/pki/koji/kojiweb.pem
 LoginTimeout = 72
 Secret = {{ web_secret }}
 LibPath = /usr/share/koji-web/lib
diff --git a/vars/default.yaml b/vars/default.yaml
index 3bda171..7f9e5bb 100644
--- a/vars/default.yaml
+++ b/vars/default.yaml
@@ -76,6 +76,10 @@ common_koji_certs_to_generate:
     cn: "{{ koji_dist_git_fqdn }}"
     is_user: false
     is_server: true
+  - name: kojiweb
+    cn: "{{ koji_hub_fqdn }}"
+    is_user: false
+    is_server: true
 
 # File Permissions
 koji_pki_dir_mode: "0755"