How to Set Up a Local Certificate Authority for Internal HTTPS

Browser warnings about “insecure” or “not private” connections are a familiar annoyance once you start accessing internal homelab services over HTTPS with self-signed certificates. Setting up a local certificate authority for your home lab solves this permanently, letting you issue trusted certificates for every internal service without relying on public certificate authorities or exposing anything to the internet.

Why Not Just Use Let’s Encrypt for Everything?

Let’s Encrypt works well for publicly accessible services, but it requires either a public domain with DNS validation or an internet-facing HTTP challenge — awkward or impossible for services that only exist on your internal network and were never meant to be reachable from outside. A local Certificate Authority (CA) solves this by letting you issue your own valid, trusted certificates entirely offline.

What Is a Certificate Authority?

A Certificate Authority is an entity that issues digital certificates, vouching for the identity of a website or service. Public CAs like Let’s Encrypt are trusted automatically by every browser and operating system by default. A private CA works identically in principle, except you control it entirely — and you’ll need to manually install your CA’s root certificate on each device that should trust certificates it issues.

Introducing step-ca

step-ca is a free, open-source certificate authority designed to be easy to run for exactly this kind of internal use case. It supports modern protocols like ACME, meaning tools that normally request certificates from Let’s Encrypt can be pointed at your own internal CA instead with minimal reconfiguration.

Installing step-ca

On Linux, download and install the step CLI and step-ca binaries from the official releases, or use your distribution’s package manager if available. Initialize a new CA:

step ca init

This interactive setup asks for your CA’s name, the DNS name or IP it will run on, and generates the root certificate along with an intermediate certificate used for actually issuing service certificates.

Starting the CA Server

step-ca $(step path)/config/ca.json

This starts the CA, ready to issue certificates over its ACME endpoint or via direct CLI requests.

Installing the Root Certificate on Your Devices

For your devices to trust certificates issued by your CA, you need to install the CA’s root certificate as a trusted authority:

• Linux: copy the root certificate into /usr/local/share/ca-certificates/ and run sudo update-ca-certificates
• Windows: import via certmgr.msc into the Trusted Root Certification Authorities store
• macOS: import via Keychain Access and mark it as trusted
• Browsers: most use the OS certificate store automatically, though Firefox maintains its own store requiring separate import

Requesting a Certificate for a Service

For a service like your Nginx Proxy Manager instance or a homelab dashboard, request a certificate directly:

step ca certificate my-service.home.lab service.crt service.key

This produces a valid certificate and private key pair you can configure directly into the service, or into Nginx Proxy Manager as a custom certificate.

Using ACME for Automatic Renewal

Since step-ca supports the ACME protocol, tools like Nginx Proxy Manager or Caddy that normally request certificates from Let’s Encrypt can instead point their ACME server URL at your internal step-ca instance, enabling the same kind of automatic certificate issuance and renewal you’d get with a public CA — just entirely internal to your network.

Final Thoughts

Setting up a local certificate authority for your home lab eliminates browser warnings for internal services while keeping everything entirely offline and under your own control. Combined with a reverse proxy like Nginx Proxy Manager, a local CA rounds out a genuinely polished, warning-free internal HTTPS setup across your entire self-hosted infrastructure.