Tutorials · Security Operations
How to Issue TLS Certificates for Internal Devices With a Private CA
Browser warnings on switches, NVRs and internal apps train users to click through security errors. Run a small private certificate authority and give every internal service a trusted certificate.
Before you start
- A Linux server for the CA (keep it well protected)
- smallstep step-ca and step CLI
- A way to distribute the root certificate to company devices (GPO, MDM)
Step by step
Initialise the CA
step ca init creates a root and intermediate certificate and a provisioner. Store the root key offline if possible.
step ca init --name "Corp Internal CA" --dns ca.corp.example --address :9000Start the CA service
Run step-ca as a service on the CA server.
step-ca $(step path)/config/ca.jsonTrust the root on company devices
Distribute root_ca.crt through Group Policy or MDM so browsers trust certificates from your CA.
Issue a certificate for a device
Create a certificate and key for an internal host name, then upload them to the device's HTTPS settings.
step ca certificate nvr01.corp.example nvr01.crt nvr01.keyAutomate renewals
Short-lived certificates are safer. Servers can renew automatically with step ca renew --daemon, or with ACME clients pointed at your CA.
Track expiry
Keep a list of every certificate, where it is installed and when it expires, and alert 30 days before.
Commands are generic, industry-standard examples. Exact syntax and menu names vary by model and firmware; check your device's manual on the Documentation page.
Pro tips
- Use host names, not IP addresses, in certificates and in bookmarks.
- Never install the CA private key on a normal server or laptop.
FAQ
Frequently asked questions
Can I use public certificates instead?
Yes, for host names in a public domain via DNS validation. A private CA is useful for devices without Internet access.
Keep learning
Related guides
Secure switch and router management
Read more →Harden Linux servers
Read more →WPA3-Enterprise with RADIUS
Read more →How to Set Up a WireGuard VPN Server for Remote Access
WireGuard is a fast, modern VPN with a small, auditable code base. Build a WireGuard server on Linux, add users with their own keys and route them only to the networks they need.
Read more →How to Scan Your Network for Vulnerabilities With Nmap and OpenVAS
Find open ports, outdated services and known vulnerabilities before attackers do. Discover hosts with Nmap, then run authenticated vulnerability scans with Greenbone OpenVAS and fix what matters first.
Read more →How to Build a Free SIEM With Wazuh for Network and Server Logs
A SIEM collects logs from servers, firewalls and switches in one place and alerts on attacks. Install Wazuh, add agents and syslog sources, and tune the first alerts.
Read more →Stuck on a step?
Ask Navijin technical support or an authorised partner for help with your configuration.