Whether it\u2019s an internal dashboard, a dev server, or some cool internal tool \u2014 let\u2019s lock it down.<\/p>\n
What You\u2019ll Need<\/h2>\n\n- A server (Linux or Windows)<\/li>\n
- Access to the command line<\/li>\n
- OpenSSL or a certificate management tool<\/li>\n
- A certificate authority (CA), internal or public<\/li>\n<\/ul>\n
Ready? Let\u2019s get started!<\/p>\n
Step 1: Create a Private Key and CSR<\/h2>\n
The first thing you need is a set of keys. One is private (keep it safe, never share), the other is public.<\/p>\n
openssl req -nodes -newkey rsa:2048 -keyout myserver.key -out myserver.csr<\/code><\/pre>\nThis command will do two things:<\/p>\n
\n- Create a 2048-bit private key (myserver.key)<\/i><\/li>\n
- Create a certificate signing request (myserver.csr)<\/i><\/li>\n<\/ol>\n
You’ll be asked to fill in some details like:<\/p>\n
\n- Country<\/b><\/li>\n
- Organization<\/b><\/li>\n
- Common name (CN)<\/b> \u2014 very important! Use the server\u2019s hostname or IP address<\/li>\n<\/ul>\n
The CSR is what you give to the Certificate Authority (CA) to get a certificate.<\/p>\n![\"\"](\"https:\/\/unitconversion.io\/blog\/wp-content\/uploads\/2026\/03\/a-computer-motherboard-is-displayed-with-light-linux-terminal-reinstall-drivers-ubuntu-command-line-nvidia-driver-setup-1.jpg\")
\n
Step 2: Sign Your Certificate<\/h2>\n
Now, you have two choices:<\/p>\n
\n- Use an internal CA<\/b> – Great for dev and test environments<\/li>\n
- Use a public CA<\/b> – Needed if you want trust out-of-the-box from browsers<\/li>\n<\/ul>\n
Option A: Use Your Own CA<\/h3>\n
If you’re using your own internal Certificate Authority:<\/p>\n
openssl x509 -req -in myserver.csr -CA myCA.crt -CAkey myCA.key -CAcreateserial -out myserver.crt -days 365 -sha256<\/code><\/pre>\nThis will give you a signed certificate: myserver.crt<\/i>.<\/p>\nOption B: Use a Public CA<\/h3>\n
Send the CSR to platforms like Let\u2019s Encrypt, or commercial providers. They\u2019ll send you back a signed certificate.<\/p>\n
Either way, you now have what you need!<\/p>\n
Step 3: Install Your Certificate<\/h2>\n
Time to put that certificate on your server. It depends on the software you use. Here are examples for some popular servers.<\/p>\n
For Apache:<\/h3>\n<VirtualHost *:443>\n ServerName internal.example.com\n SSLEngine on\n SSLCertificateFile \/path\/to\/myserver.crt\n SSLCertificateKeyFile \/path\/to\/myserver.key\n SSLCertificateChainFile \/path\/to\/ca_bundle.crt\n<\/VirtualHost><\/code><\/pre>\nDon\u2019t forget to enable SSL module:<\/p>\n
a2enmod ssl\nsystemctl restart apache2<\/code><\/pre>\nFor Nginx:<\/h3>\nserver {\n listen 443 ssl;\n server_name internal.example.com;\n\n ssl_certificate \/path\/to\/myserver.crt;\n ssl_certificate_key \/path\/to\/myserver.key;\n\n location \/ {\n proxy_pass http:\/\/localhost:3000;\n }\n}<\/code><\/pre>\nThen restart:<\/p>\n
systemctl restart nginx<\/code><\/pre>\nImage not found in postmeta
\nStep 4: Trust Your Internal CA (If Needed)<\/h2>\n
If you used your own CA, client machines need to trust it.<\/p>\n
On Windows:<\/h3>\n\n- Double-click the CA .crt<\/i> file<\/li>\n
- Click \u201cInstall Certificate\u201d<\/li>\n
- Choose \u201cTrusted Root Certification Authorities\u201d<\/li>\n<\/ol>\n
On Linux:<\/h3>\n
Copy the CA certificate to your trust store and update it.<\/p>\n
sudo cp myCA.crt \/usr\/local\/share\/ca-certificates\/\nsudo update-ca-certificates<\/code><\/pre>\nNow your browsers and CLI tools will trust the cert!<\/p>\n
Step 5: Automate Certificate Renewal<\/h2>\n
SSL certs don\u2019t last forever. Set up reminders or auto-renew if possible.<\/p>\n
For Let\u2019s Encrypt:<\/h3>\nsudo certbot renew --dry-run<\/code><\/pre>\nAdd a cron job to do it monthly. Or use a system timer.<\/p>\n
Internal CA?<\/h3>\n
You\u2019ll need a script that:<\/p>\n
Ready? Let\u2019s get started!<\/p>\n
Step 1: Create a Private Key and CSR<\/h2>\n
The first thing you need is a set of keys. One is private (keep it safe, never share), the other is public.<\/p>\n
openssl req -nodes -newkey rsa:2048 -keyout myserver.key -out myserver.csr<\/code><\/pre>\nThis command will do two things:<\/p>\n
\n- Create a 2048-bit private key (myserver.key)<\/i><\/li>\n
- Create a certificate signing request (myserver.csr)<\/i><\/li>\n<\/ol>\n
You’ll be asked to fill in some details like:<\/p>\n
\n- Country<\/b><\/li>\n
- Organization<\/b><\/li>\n
- Common name (CN)<\/b> \u2014 very important! Use the server\u2019s hostname or IP address<\/li>\n<\/ul>\n
The CSR is what you give to the Certificate Authority (CA) to get a certificate.<\/p>\n\n
Step 2: Sign Your Certificate<\/h2>\n
Now, you have two choices:<\/p>\n
\n- Use an internal CA<\/b> – Great for dev and test environments<\/li>\n
- Use a public CA<\/b> – Needed if you want trust out-of-the-box from browsers<\/li>\n<\/ul>\n
Option A: Use Your Own CA<\/h3>\n
If you’re using your own internal Certificate Authority:<\/p>\n
openssl x509 -req -in myserver.csr -CA myCA.crt -CAkey myCA.key -CAcreateserial -out myserver.crt -days 365 -sha256<\/code><\/pre>\nThis will give you a signed certificate: myserver.crt<\/i>.<\/p>\nOption B: Use a Public CA<\/h3>\n
Send the CSR to platforms like Let\u2019s Encrypt, or commercial providers. They\u2019ll send you back a signed certificate.<\/p>\n
Either way, you now have what you need!<\/p>\n
Step 3: Install Your Certificate<\/h2>\n
Time to put that certificate on your server. It depends on the software you use. Here are examples for some popular servers.<\/p>\n
For Apache:<\/h3>\n<VirtualHost *:443>\n ServerName internal.example.com\n SSLEngine on\n SSLCertificateFile \/path\/to\/myserver.crt\n SSLCertificateKeyFile \/path\/to\/myserver.key\n SSLCertificateChainFile \/path\/to\/ca_bundle.crt\n<\/VirtualHost><\/code><\/pre>\nDon\u2019t forget to enable SSL module:<\/p>\n
a2enmod ssl\nsystemctl restart apache2<\/code><\/pre>\nFor Nginx:<\/h3>\nserver {\n listen 443 ssl;\n server_name internal.example.com;\n\n ssl_certificate \/path\/to\/myserver.crt;\n ssl_certificate_key \/path\/to\/myserver.key;\n\n location \/ {\n proxy_pass http:\/\/localhost:3000;\n }\n}<\/code><\/pre>\nThen restart:<\/p>\n
systemctl restart nginx<\/code><\/pre>\nImage not found in postmeta
\nStep 4: Trust Your Internal CA (If Needed)<\/h2>\n
If you used your own CA, client machines need to trust it.<\/p>\n
On Windows:<\/h3>\n\n- Double-click the CA .crt<\/i> file<\/li>\n
- Click \u201cInstall Certificate\u201d<\/li>\n
- Choose \u201cTrusted Root Certification Authorities\u201d<\/li>\n<\/ol>\n
On Linux:<\/h3>\n
Copy the CA certificate to your trust store and update it.<\/p>\n
sudo cp myCA.crt \/usr\/local\/share\/ca-certificates\/\nsudo update-ca-certificates<\/code><\/pre>\nNow your browsers and CLI tools will trust the cert!<\/p>\n
Step 5: Automate Certificate Renewal<\/h2>\n
SSL certs don\u2019t last forever. Set up reminders or auto-renew if possible.<\/p>\n
For Let\u2019s Encrypt:<\/h3>\nsudo certbot renew --dry-run<\/code><\/pre>\nAdd a cron job to do it monthly. Or use a system timer.<\/p>\n
Internal CA?<\/h3>\n
You\u2019ll need a script that:<\/p>\n