A private certificate authority (CA) on Debian 10 lets your organization issue and validate certificates for internal websites, APIs, devices, and services. The CA’s protected private key signs certificates; clients need the corresponding public root certificate (or a trusted intermediate chain) to accept them. This guide builds a small root CA with OpenSSL, signs a service certificate with proper Subject Alternative Names (SANs), installs trust on Debian clients, and verifies the complete TLS chain.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Keep the root key encrypted and away from ordinary service hosts. If certificates will be issued regularly or by several administrators, use an intermediate CA and a structured OpenSSL configuration or easy-rsa rather than repeatedly signing files by hand.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsWhat a private CA does
A CA is a root of trust. Its private key signs an issuer certificate, and that signature allows a client to verify that a server certificate came from an authority the client trusts. The root certificate is public; the root private key is the signing authority and must remain secret.
Installing a root certificate does not automatically make every certificate valid. A client must be able to build a complete chain from the server certificate to a trusted root, and the certificate must be valid for the name being used. If the issuer cannot be found in the trust store, OpenSSL commonly reports unable to get local issuer certificate.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Root and intermediate choices
| Design | Best fit | Key custody and issuance |
|---|---|---|
| Single self-signed root | One-off lab or small, tightly controlled environment | The root key signs service certificates directly. It is simple but must be unlocked whenever a certificate is issued. |
| Offline root plus intermediate | Repeated issuance, multiple administrators, or production-like internal PKI | The root signs an intermediate once. Routine service certificates are signed by the intermediate, while the root stays offline or on a restricted administration host. |
| Structured OpenSSL configuration or easy-rsa | Several certificates, renewals, and revocation tracking | Automates serial numbers, certificate records, revocation data, and repeatable issuance more reliably than ad-hoc commands. |
For a small controlled CA, the procedure below uses raw OpenSSL commands. It keeps the files explicit so you can see what is being created and where it is stored.
Prerequisites and package installation
Use an administrator account with sudo on the Debian 10 machine that will hold the CA. Confirm the OpenSSL version shipped with that installation before relying on options from a different release; keep the syntax compatible with the installed version.
sudo apt update
sudo apt install openssl ca-certificates
# Optional helper workflow for a managed private PKI:
sudo apt install easy-rsaThe openssl package supplies key and certificate commands. ca-certificates supplies Debian’s system trust-store tooling. easy-rsa is optional; it provides a repeatable private X.509 workflow when you need more bookkeeping than a one-off CA.
Create a protected CA workspace
Place the CA outside web, application, and ordinary backup directories. The root private-key directory should be readable only by root. Certificate and CSR directories can be readable by administrators as appropriate, but do not loosen permissions on the key.
sudo install -d -m 700 -o root -g root /etc/ca
sudo install -d -m 700 -o root -g root /etc/ca/private
sudo install -d -m 755 -o root -g root /etc/ca/certs
sudo install -d -m 755 -o root -g root /etc/ca/csr/etc/ca/privateholds the encrypted root key and service private keys./etc/ca/certsholds public certificates./etc/ca/csrholds certificate signing requests and extension files.- Back up the root key only in encrypted storage, and test restoration under controlled administrative procedures.
Generate the encrypted root key and certificate
Create the root private key
The 4096-bit RSA key below is encrypted with AES-256. OpenSSL will prompt for a passphrase. Use a passphrase that is not stored beside the key; losing it prevents the key from being used, while exposing it lets an attacker impersonate your CA.
sudo openssl genrsa -aes256 -out /etc/ca/private/ca.key.pem 4096
sudo chmod 600 /etc/ca/private/ca.key.pemOnly the administrator who performs CA operations should be able to read this file. Never copy it to an application server, web directory, container image, or an unencrypted backup.
Create a self-signed root certificate
Create a long-lived root certificate with a clear organization and CA name. The example uses 3,650 days (approximately ten years); choose a lifetime that matches your organization’s renewal and key-rotation policy.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
sudo openssl req -x509 -new -sha256 -days 3650
-key /etc/ca/private/ca.key.pem
-out /etc/ca/certs/ca.cert.pem
-subj "/C=US/O=Example Organization/CN=Example Internal Root CA"
sudo chmod 644 /etc/ca/certs/ca.cert.pemRecord the certificate’s SHA-256 fingerprint through a separate, trusted channel. Administrators can compare that fingerprint later to detect a substituted root certificate.
sudo openssl x509 -in /etc/ca/certs/ca.cert.pem -noout
-subject -issuer -dates -fingerprint -sha256A self-signed root normally shows the same subject and issuer. The certificate is safe to distribute; the private key is not.
Create a service private key and CSR
Generate the service key
Generate a separate private key for each service. The example uses a 2048-bit RSA key and restricts it to the service administrator.
Free tools Windows power users keep installed
One-click scans. No signup required.
sudo openssl genrsa -out /etc/ca/private/app01.key.pem 2048
sudo chmod 600 /etc/ca/private/app01.key.pemCreate the certificate signing request
The Common Name identifies the request but is not a reliable hostname identity on its own. Clients use the certificate’s Subject Alternative Name extension, so list every DNS name or IP address that clients will actually use.
sudo openssl req -new -sha256
-key /etc/ca/private/app01.key.pem
-out /etc/ca/csr/app01.csr.pem
-subj "/C=US/O=Example Organization/CN=app01.example.internal"A CSR contains the public key and requested subject information; it does not contain the service’s private key. Review the requested names before signing. Do not add a wildcard or an IP address unless there is a specific operational requirement for it.
Write certificate extensions
Create /etc/ca/csr/app01.ext with the constraints and usages appropriate for a TLS server:
basicConstraints = critical, CA:FALSE
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName = DNS:app01.example.internal,IP:192.0.2.10basicConstraints = critical, CA:FALSEprevents this leaf certificate from being used as a CA.keyUsagelimits the key to the operations needed by the selected TLS setup.extendedKeyUsage = serverAuthidentifies the certificate for server authentication.subjectAltNamecontains the names clients validate. Add additionalDNS:orIP:entries only when those names are genuinely served by the endpoint.
Sign the service CSR
For a small CA, sign the CSR directly with the root certificate. The command creates a serial-number file next to the CA certificate; keep serial information with your CA records and do not casually delete or overwrite it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
sudo openssl x509 -req -sha256 -days 825
-in /etc/ca/csr/app01.csr.pem
-CA /etc/ca/certs/ca.cert.pem
-CAkey /etc/ca/private/ca.key.pem
-CAcreateserial
-out /etc/ca/certs/app01.cert.pem
-extfile /etc/ca/csr/app01.ext
sudo chmod 644 /etc/ca/certs/app01.cert.pemOpenSSL prompts for the encrypted CA-key passphrase. The 825-day validity in this example is a certificate-lifetime choice for the leaf certificate, not a universal requirement; set it according to your renewal policy and the clients you support.
Inspect the result immediately:
sudo openssl x509 -in /etc/ca/certs/app01.cert.pem -noout
-subject -issuer -dates -ext subjectAltNameConfirm that the subject, issuer, validity dates, and SAN values are exactly what the service needs. A certificate with the wrong SAN will fail hostname validation even if its signature and trust chain are otherwise correct.
Using an intermediate CA
For a larger environment, create an intermediate CA and have the root sign the intermediate certificate once. Use the intermediate’s key to sign service CSRs. Configure each service to send its leaf certificate followed by the intermediate certificate. Clients generally need to trust only the root; they obtain the intermediate from the server’s presented chain.
Keep the root private key offline or on a tightly controlled administration host whenever possible. The intermediate becomes the routine signing key, so protect it as a CA key and maintain issuance, serial-number, renewal, and revocation records.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Install the CA certificate on Debian clients
Debian’s system trust path accepts local CA certificates as individual .crt files in /usr/local/share/ca-certificates/. Copy only the public root certificate (or the public trust anchor selected by your PKI), then rebuild the system bundle.
sudo install -m 644 ca.cert.pem
/usr/local/share/ca-certificates/example-internal-root.crt
sudo update-ca-certificatesThe update command refreshes links under /etc/ssl/certs/ and the combined bundle at /etc/ssl/certs/ca-certificates.crt. Use a single .crt file for each local CA. Do not install the CA private key on clients.
Applications with separate trust stores
System trust is not universal. Some browsers, Java runtimes, Python environments, containers, and application SDKs maintain their own trust stores or CA settings. If a program still rejects the certificate after the Debian bundle is updated, import the public root or intermediate into that program’s documented trust store, or configure it to use the system bundle. Keep the same fingerprint and chain review for every store.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Configure the service certificate and chain
Install the service’s private key and certificate according to the server software’s permissions and configuration rules. The private key should be readable only by the service account or a tightly controlled startup mechanism.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →- For a direct-root design, the service presents
app01.cert.pem; clients trustca.cert.pem. - For an intermediate design, concatenate or configure the leaf certificate followed by the intermediate certificate in the server’s certificate-chain setting. Do not send the root certificate as a substitute for the intermediate.
- Ensure the endpoint actually serves the certificate whose SANs contain the hostname clients use.
Restart or reload the service using its normal administrative procedure, then test the live endpoint rather than only the files on disk.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Verify the CA, certificate, and live TLS endpoint
Verify against Debian’s system bundle
Run this on a Debian client after installing the root certificate:
sudo openssl verify
-CAfile /etc/ssl/certs/ca-certificates.crt
/etc/ca/certs/app01.cert.pemA successful result identifies the certificate as OK. If verification fails, read the error literally: an unknown issuer usually means the correct root or intermediate is absent from the trust input; an expired certificate needs renewal; a name mismatch requires corrected SANs or the correct hostname.
Test the endpoint with SNI
Use the hostname clients will request and send Server Name Indication (SNI):
openssl s_client -connect app01.example.internal:443
-servername app01.example.internal
-CAfile /etc/ssl/certs/ca-certificates.crt </dev/nullInspect the displayed chain, issuer, dates, and verification result. The s_client command is a diagnostic tool: a successful TCP/TLS connection alone does not prove that a particular browser or application will accept the certificate. Check the SAN, trust store, protocol configuration, and application-specific validation separately.
Pre-production checklist
- The root key is encrypted, mode
600, and absent from service hosts. - The root certificate fingerprint is recorded out of band.
- Every client-facing DNS name and IP address appears in SAN.
- The leaf has
CA:FALSE, appropriate key usage, andserverAuth. - The issuer is the intended root or intermediate.
- The certificate is within its validity period and renewal owner is documented.
- The server presents the complete leaf-plus-intermediate chain when an intermediate is used.
- Debian clients and any separate application trust stores contain the intended public trust anchor.
- Serial numbers, issued certificates, renewal dates, and revocation decisions are recorded.
Common failures and fixes
“Unable to get local issuer certificate”
The verifier cannot find the issuer in its CAfile or CApath. Install the correct public root on the client, provide the intermediate in the server’s chain, and repeat verification with the intended trust file. Do not solve this by distributing the CA private key.
Hostname or certificate-name mismatch
Modern clients validate SAN entries. If the user connects to api.example.internal but the certificate contains only app01.example.internal in its SAN, issue a new certificate with the real name. Changing only the Common Name is not a dependable fix.
One client works while another fails
Compare trust stores. The working program may use Debian’s updated bundle while the failing browser, Java runtime, container, Python environment, or SDK uses a separate store. Import the same public CA certificate into the failing program’s supported store and verify its chain.
The server sends an incomplete chain
With an intermediate CA, clients may trust the root but still fail if the server sends only the leaf. Configure the service to send the leaf followed by the intermediate, then rerun openssl s_client and inspect every certificate in the chain.
The CA key cannot be used
An encrypted key requires its passphrase. If the passphrase is unavailable, the key cannot sign new certificates; restore the encrypted backup under controlled procedures or establish a replacement CA and plan client trust migration. Never remove encryption merely to make unattended signing easier.
Renewal, revocation, and retirement
Plan before issuing broadly
Choose certificate lifetimes, assign renewal ownership, retain serial-number records, and define how compromised or retired certificates will be revoked. A CA that works for one test server becomes risky when several administrators issue certificates without shared records.
Back up and protect keys
Back up the encrypted root key and any required CA database or serial files in encrypted storage. Test restoration with limited administrators. Distribute only public root and intermediate certificates; application hosts should never receive a CA private key.
Recommended Free Tools
Retire a local trust anchor
When a local root is no longer trusted, remove its Debian trust-store file and rebuild the bundle:
sudo rm /usr/local/share/ca-certificates/example-internal-root.crt
sudo update-ca-certificates --freshAfter removal, verify that clients reject certificates signed only by the retired CA. Also remove the trust anchor from browser, Java, container, and application-specific stores where it was imported.
OpenSSL commands or easy-rsa?
| Question | Raw OpenSSL commands | easy-rsa or an OpenSSL CA configuration |
|---|---|---|
| Transparency | Every key, CSR, extension, and signing action is visible in the command line. | Workflow conventions hide some command details but provide consistent defaults. |
| One-off lab CA | Fast and understandable for a small number of certificates. | More setup than necessary for a single experiment. |
| Multiple administrators | Requires your own file naming, serial, and approval discipline. | Repeatable issuance reduces bookkeeping mistakes. |
| Serial and revocation records | You must preserve serial files and build a tracking process. | Designed to maintain issuance and revocation data as part of the workflow. |
| Offline-root operation | Possible, but you must design the intermediate process yourself. | Supports a structured hierarchy when configured for an offline root and routine intermediate issuance. |
| Automation integration | Flexible scripts, with a greater risk of unsafe argument or extension handling. | More predictable for repeated, policy-driven automation. |
Use direct OpenSSL for a transparent, controlled lab or very small deployment. Move to an intermediate hierarchy and structured tooling when issuance, renewal, revocation, or administrator count grows.
Quick Recap
Final operating rules
- Protect and encrypt the root private key; keep it offline or on a restricted administration host whenever practical.
- Use an intermediate CA for routine production issuance.
- Put every client-used DNS name and IP address in SAN.
- Install only public CA certificates in client trust stores.
- Present the complete intermediate chain from services.
- Record fingerprints, serial numbers, validity periods, renewals, and revocations.
- Test both certificate files and the live endpoint with the same hostname and trust store your applications use.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
