To set up a private certificate authority on Debian 10, install OpenSSL, create a root key and self-signed root certificate in a locked-down directory, issue server certificates with correct Subject Alternative Names (SANs), install the root certificate in each client’s trust store, and verify the complete chain before production use. Keep the root private key encrypted and away from ordinary service hosts; for repeated issuance, use an intermediate CA so the root is needed only to sign that intermediate.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What a private CA does
A certificate authority (CA) is the root of trust for an internal public-key infrastructure (PKI). The CA’s private key signs certificates. Clients receive the corresponding public root certificate (or a chain ending at that root) and use it to validate certificates presented by servers. The Debian Administrator’s Handbook describes the requirement this way: applications using X.509 can check presented certificates when they know the trusted root certificates.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesThis guide creates a small private CA using the OpenSSL commands available on a Debian 10 installation. It then creates a server key and certificate for app01.example.internal, distributes the CA certificate to Debian clients, and tests the result. Replace the example organization, hostnames, and IP address with values from your own environment.
Plan the trust hierarchy before generating keys
Root-only CA for a small lab
A single self-signed root can sign service certificates directly. This is transparent and practical for a lab or a small, tightly controlled network, but every certificate issuance requires access to the root private key. If that key is stolen, an attacker can impersonate any service trusted by your clients.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Offline root with an intermediate CA
For an environment with multiple administrators or frequent issuance, create an intermediate CA and use it for routine signing. The root signs the intermediate once and can then remain offline or on a dedicated administration host. Services send their leaf certificate followed by the intermediate certificate; clients normally trust only the root. Revoking or replacing an intermediate limits the blast radius compared with exposing the root key for every issuance.
- Keep the root key encrypted with a strong passphrase.
- Restrict the key to administrators and never copy it to a web, application, or ordinary backup directory.
- Back up the encrypted key and CA metadata, and test restoration under controlled administration procedures.
- Record the root certificate’s SHA-256 fingerprint through a separate, trusted channel.
Install OpenSSL and trust-store tools
Update the package index and install OpenSSL plus Debian’s CA certificate tooling:
sudo apt update
sudo apt install openssl ca-certificatesca-certificates provides the commands and directory conventions used to add a local root to Debian’s system trust store. The optional easy-rsa package supplies a structured workflow for issuing and tracking certificates:
sudo apt install easy-rsaCheck the OpenSSL release shipped by the particular Debian 10 installation before relying on options introduced in later releases. The commands below use the traditional syntax supported by Debian 10’s OpenSSL package.
Create a protected CA workspace
Keep CA material outside application directories. The following layout separates the private key, issued certificates, and incoming CSRs:
sudo install -d -m 700 -o root -g root /etc/ca
sudo install -d -m 700 -o root -g root /etc/ca/private
sudo install -d -m 755 -o root -g root /etc/ca/certs
sudo install -d -m 755 -o root -g root /etc/ca/csrThe private directory and the CA key must be readable only by root (or by a deliberately chosen administrative account). Certificate and CSR directories contain public material, so they can use mode 755 if your operational policy permits it. Do not place the root key in a web root, application volume, broadly readable backup, or service host.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Generate the encrypted root key and self-signed certificate
1. Create the root private key
Generate a 4096-bit RSA key encrypted with AES-256:
sudo openssl genrsa -aes256 -out /etc/ca/private/ca.key.pem 4096
sudo chmod 600 /etc/ca/private/ca.key.pemOpenSSL asks for a passphrase. Use a passphrase that can be retrieved through your organization’s controlled key-management procedure; losing it makes the CA key unusable, while disclosing it defeats the protection. The root key is the signing authority and must remain secret.
2. Create the self-signed root certificate
Create a ten-year root certificate with SHA-256:
sudo openssl req -x509 -new -sha256 -days 3650
-key /etc/ca/private/ca.key.pem
-out /etc/ca/certs/ca.cert.pem
-subj "/C=US/O=Example Organization/CN=Example Internal Root CA"
sudo chmod 644 /etc/ca/certs/ca.cert.pemThe -subj value is an example. Choose a country, organization, and CA common name that will remain unambiguous in certificate lists. This certificate is public; only the corresponding key requires secrecy.
3. Inspect and record the certificate identity
sudo openssl x509 -in /etc/ca/certs/ca.cert.pem -noout
-subject -issuer -dates -fingerprint -sha256A self-signed root normally shows the same subject and issuer. Record the SHA-256 fingerprint out of band, such as in a protected administration runbook. Administrators can compare that value later to detect a substituted root certificate.
Create a server key and certificate signing request
1. Generate the service private key
Create a key for the service that will terminate TLS:
sudo openssl genrsa -out /etc/ca/private/app01.key.pem 2048
sudo chmod 600 /etc/ca/private/app01.key.pemThis example uses a 2048-bit RSA service key. Protect it on the service host with the permissions required by the daemon, and encrypt it at rest when the daemon supports passphrase-protected keys and unattended startup is not required.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
2. Create the CSR
sudo openssl req -new -sha256
-key /etc/ca/private/app01.key.pem
-out /etc/ca/csr/app01.csr.pem
-subj "/C=US/O=Example Organization/CN=app01.example.internal"A certificate signing request (CSR) contains the public key and requested subject, but it is not trusted until a CA signs it. The common name is useful for identification, but modern hostname validation relies on SAN entries.
3. Prepare the extensions file with every real name
Create /etc/ca/csr/app01.ext with the identities clients will actually use:
Free tools Windows power users keep installed
One-click scans. No signup required.
basicConstraints = critical, CA:FALSE
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName = DNS:app01.example.internal,IP:192.0.2.10List each DNS name and IP address that users, load balancers, monitoring systems, or other clients may use. A client connecting by an address not present in SAN will reject the certificate even if the common name looks correct. Do not add a wildcard or an IP address without an explicit operational requirement. Review this file before signing because the CA will certify the identities it contains.
Sign the CSR with a small root-only CA
For a one-off or tightly controlled CA, sign the CSR directly:
sudo openssl x509 -req -sha256 -days 825
-in /etc/ca/csr/app01.csr.pem
-CA /etc/ca/certs/ca.cert.pem
-CAkey /etc/ca/private/ca.key.pem
-CAcreateserial
-out /etc/ca/certs/app01.cert.pem
-extfile /etc/ca/csr/app01.ext
sudo chmod 644 /etc/ca/certs/app01.cert.pem
sudo openssl x509 -in /etc/ca/certs/app01.cert.pem -noout
-subject -issuer -dates -ext subjectAltNameOpenSSL prompts for the encrypted root-key passphrase. The -CAcreateserial option creates a serial-number file for this signing operation; protect and retain that file with the CA records. The resulting leaf certificate is valid for 825 days in this example. Treat that as an issuance choice, not a universal policy: establish your own lifetime and renewal schedule before issuing broadly.
Confirm that the displayed issuer is your intended CA, the SAN list is complete, the validity dates are expected, and the certificate is not marked as a CA. The extension file sets basicConstraints to CA:FALSE, permits digital signatures and key encipherment, and limits extended use to server authentication.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Use an intermediate CA for routine issuance
In a larger deployment, generate an intermediate key and CSR, sign that CSR with the protected root, and mark the intermediate certificate as a CA with a path-length policy appropriate to your hierarchy. Then use the intermediate’s key and certificate when signing service CSRs. The exact OpenSSL CA configuration should record issued serial numbers, certificate state, and revocation data consistently; an OpenSSL configuration or easy-rsa workflow is preferable to ad-hoc commands when several people issue certificates.
Configure each TLS service to present its leaf certificate followed immediately by the intermediate certificate. Do not send the root certificate as part of the service chain unless a particular client explicitly requires it. Clients should trust the root through their trust store and build the chain from the leaf to the intermediate and then to that root.
Install the service certificate and chain
Copy app01.key.pem and app01.cert.pem to the service host using an administrator-controlled transfer. Set ownership and permissions for the TLS daemon, keeping the private key inaccessible to unrelated users. When an intermediate is present, create the chain file in leaf-first order:
cat app01.cert.pem intermediate.cert.pem > app01-fullchain.pemPoint the service’s certificate setting at the leaf or full-chain file according to that daemon’s documentation, and point its private-key setting at app01.key.pem. Reload or restart the service using its normal Debian unit procedure, then test the endpoint from a client that has the root installed.
Distribute the root certificate to Debian clients
Debian’s system trust path accepts local CA certificates as individual .crt files under /usr/local/share/ca-certificates/. Install the public root certificate and rebuild the trust indexes:
sudo install -m 644 ca.cert.pem
/usr/local/share/ca-certificates/example-internal-root.crt
sudo update-ca-certificatesThe update command refreshes links under /etc/ssl/certs/ and rebuilds /etc/ssl/certs/ca-certificates.crt. The file must contain a single certificate with a .crt extension; do not place a private key there. Distribute the intermediate only where an application needs it to build a chain; the root is the trust anchor.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
System trust is not universal. Some browsers, Java runtimes, Python environments, containers, and application SDKs maintain separate stores. Import the public root (and, where required, the intermediate) through that product’s documented mechanism, then repeat verification from the same runtime that will make the connection.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Verify the certificate before production
Verify the chain against Debian’s system bundle
sudo openssl verify -CAfile /etc/ssl/certs/ca-certificates.crt
/etc/ca/certs/app01.cert.pemA successful result names the certificate and reports OK. If the certificate was issued by an intermediate, provide the intermediate as an untrusted chain input in the form supported by the installed OpenSSL version, or verify the service’s full chain with s_client as shown below.
Recommended Free Tools
Inspect the live TLS endpoint
openssl s_client -connect app01.example.internal:443
-servername app01.example.internal
-CAfile /etc/ssl/certs/ca-certificates.crt </dev/nullThe -servername option sends the hostname used for SNI, ensuring that a virtual-hosted server returns the intended certificate. Review the output for the issuer, SAN, validity dates, and verification status, and confirm that the endpoint sends the leaf followed by any intermediate certificates. A successful TCP/TLS session from s_client is diagnostic evidence, not proof that every application will accept the certificate.
Use a pre-production checklist
- The client trusts the intended root or a trusted chain ending at that root.
- The certificate is currently within its
notBeforeandnotAfterdates. - The issuer is the expected root or intermediate CA.
- Every hostname and IP address used by clients appears in SAN.
basicConstraints,keyUsage, andextendedKeyUsagematch the service role.- The endpoint presents a complete leaf-to-intermediate chain.
- The private key on the service host matches the certificate’s public key and is readable only by the required daemon account.
Fix common trust and issuance failures
| Symptom | Likely cause | Action |
|---|---|---|
unable to get local issuer certificate |
The client cannot find the issuing CA in its trust store or the server omitted an intermediate. | Install the correct public root, supply the intermediate in the server’s chain, run update-ca-certificates, and test from the affected application’s own trust store. |
| Hostname or IP mismatch | The name used for the connection is absent from SAN. | Issue a new certificate with every required DNS name or IP in subjectAltName; changing only the common name is insufficient. |
| Certificate appears expired or not yet valid | The validity period is wrong or the client clock is inaccurate. | Inspect -dates output, correct time synchronization, or renew with a new certificate. |
| Private CA works with one program but not another | The programs use separate trust stores. | Import the public CA certificate into the browser, Java, Python, container, or SDK store used by the failing program. |
| Service returns the wrong certificate | SNI, virtual-host configuration, or certificate path is incorrect. | Use the exact hostname with -servername, inspect the daemon configuration, and reload it after replacing the certificate. |
| Signing command cannot read the CA key | Permissions or the root-key passphrase are wrong. | Run the operation as the controlled CA administrator, verify mode 600 on the key, and retrieve the passphrase through the approved procedure; do not remove encryption casually. |
Choose between raw OpenSSL and easy-rsa
| Consideration | Raw OpenSSL commands/configuration | easy-rsa |
|---|---|---|
| Best fit | One-off lab CA or administrators who need complete visibility into every command. | Repeated issuance where a structured workflow is more important than hand-written commands. |
| Key custody and offline root | Possible, but you must design the directory layout, permissions, and transfer process. | Provides a repeatable workflow that can support a separate root and issuing CA when configured accordingly. |
| Serial and revocation bookkeeping | You must preserve serial files and maintain issuance and revocation records correctly. | Automates more of the certificate database and lifecycle bookkeeping. |
| Multiple administrators | Consistency depends on everyone following the same configuration and procedures. | Standardized commands reduce differences between administrators. |
| Automation integration | Flexible for scripts, but scripts must handle errors, identity extensions, and records safely. | Useful when automation needs a consistent command set and directory structure. |
| Client trust distribution | Still requires you to distribute the public root or chain through Debian and application-specific stores. | Does not remove the need to deploy the correct trust chain to clients. |
For a single internal service, the direct OpenSSL flow is easy to audit. For a team issuing many certificates, select a managed OpenSSL configuration or easy-rsa before the CA accumulates production certificates; migrating serial and revocation records later is harder than starting with consistent bookkeeping.
Operate the CA safely after initial setup
Protect and back up the root
Keep the encrypted root key offline or on a tightly controlled administration host. Back up the key, root certificate, intermediate certificates, configuration, serial data, and revocation records as an encrypted set. Test that an authorized administrator can restore the set without exposing it to service operators.
Define issuance and renewal ownership
Document who approves a CSR, who reviews SAN values, who signs it, and who installs the resulting certificate. Set certificate lifetimes and renewal reminders before the first production certificate approaches expiry. Every issued serial number should map to an owner, service, SAN list, issuance date, and expiration date.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallPlan revocation
Decide how to revoke a certificate when a service key is exposed, a hostname is retired, or an administrator leaves. Keep revocation data with the CA records and publish or distribute revocation information in a way your clients and applications actually check. If your environment cannot reliably consume revocation status, compensate with short lifetimes, rapid renewal, and a documented emergency trust-removal procedure.
Retire a local root cleanly
When the CA is replaced, remove its public certificate from Debian’s local directory and rebuild the bundle:
sudo rm /usr/local/share/ca-certificates/example-internal-root.crt
sudo update-ca-certificates --freshThen verify that clients reject certificates signed only by the retired CA. Removing a root from one system does not remove copies imported into browsers, Java stores, containers, or other application-specific locations; retire those copies as part of the same change.
Quick Recap
Final deployment checklist
- Root key is encrypted, mode 600, backed up securely, and absent from service hosts.
- Root certificate fingerprint is recorded through a trusted out-of-band process.
- Service CSR includes a reviewed SAN list covering every real connection name.
- Leaf certificate has
CA:FALSEand appropriate key and extended-key usages. - Serial and renewal records are stored with the CA, not scattered across application directories.
- Intermediate chain is installed on the service when an intermediate CA signs the leaf.
- Debian clients have the public root in
/usr/local/share/ca-certificates/and have runupdate-ca-certificates. - Separate browser, runtime, container, and SDK stores have been updated where required.
openssl verifyand ans_clienttest pass from the same environment that will connect in production.- Renewal, revocation, emergency key-compromise, and CA-retirement procedures have named owners.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
