---
title: Deploy CA certificates to edge devices
slug: edgemanager/deploy-ca-certificates-to-edge-devices
docTags: 
createdAt: 2026-06-11T14:06:46.716Z
---

A custom CA certificate allows edge device connectors to trust services signed by a private or internal Certificate Authority (CA). This is necessary in enterprise environments where Deep Packet Inspection (DPI) appliances or SSL proxies intercept and re-sign traffic using internal CAs that edge devices do not recognize by default. To deploy custom CA certificates, you upload them centrally in the Litmus Edge Manager (LEM) Admin Console, then sync them to your edge devices from the User UI.

:::hint{type="info"}
**Note:** Also see [CA Certificates](docId\:wNTbbc0Rakl30ieGnt6iB) and [Certificates](docId\:T69a-certificates) for overview and background information.
:::

## Before you begin

Before you manage CA certificates, ensure you have:

- Administrative access to the Litmus Edge Manager Admin Console
- A CA certificate file in `.pem`, `.crt`, or `.cer` format
- One or more edge devices connected to LEM
- Litmus Edge Manager version 2.34.0 or later

## Step 1: Upload a CA certificate in the Admin Console

To add a CA certificate to the LEM instance:

1. In the LEM Admin Console, select **Edge Devices** > **CA Certificates**.
   The *CA Certificates* page appears.

   ::Image[]{src="https://api.archbee.com/api/optimize/SSUUxKZUk9bFTEPNn_6Zo/r837Dy4Z3uZ1N3WoKeYYf_image.png" size="80" width="1283" height="467" position="flex-start" darkWidth="1283" darkHeight="467" showCaption="false"}
2. Click the **Upload CA Certificate** **+** icon.
3. The *Upload CA Certificate* dialog, click **Choose**. Navigate to and select your certificate file.

   ![](https://api.archbee.com/api/optimize/SSUUxKZUk9bFTEPNn_6Zo/Vu_sEIFwJlabIjk6hX9PG_image.png)
4. Review the certificate information displayed in the dialog.
5. Click **Confirm Upload**.

   ::Image[]{src="https://api.archbee.com/api/optimize/SSUUxKZUk9bFTEPNn_6Zo/n-fqX90qWW4O7querIa-D_image.png" size="80" width="1152" height="272" position="flex-start" darkWidth="1152" darkHeight="272" showCaption="false"}

The certificate appears in the *CA Certificates* list and is queued for deployment to connected edge devices.

::Image[]{src="https://api.archbee.com/api/optimize/SSUUxKZUk9bFTEPNn_6Zo/k6RgHEZp8j8TW-uSL6JvQ_image.png" size="80" width="1092" height="301" position="flex-start" darkWidth="1092" darkHeight="301" showCaption="false"}

:::hint{type="info"}
**Note:** Newly activated devices receive the current CA bundle automatically during provisioning and do not require a manual sync.
:::

## Step 2: Sync CA certificates to edge devices

After uploading a certificate, you must sync it to your edge devices. Syncing is managed at the project level from the User UI.

To sync CA certificates to your edge devices:

1. In Litmus Edge Manager, select a company and project.
2. From the navigation panel, select **Certificates**..
3. In the *Certificates Management* page, a message displays indicating that devices are not synced.

   ![](https://api.archbee.com/api/optimize/SSUUxKZUk9bFTEPNn_6Zo/D7j9N_u77yI9NZclbexTO_image.png)
4. Click **Sync CA Certificates**.
5. The *Sync CA Certificates* dialog, select one or more devices to sync. Click **Next**.

::Image[]{src="https://api.archbee.com/api/optimize/SSUUxKZUk9bFTEPNn_6Zo/J-LDN0LhagcyTvjDtN17X_image.png" size="100" width="1536" height="558" darkWidth="1536" darkHeight="558" position="flex-start" showCaption="false" indent="1"}

7. In the *Review* tab, click **Sync**. Synchronization runs in the background.

   ![](https://api.archbee.com/api/optimize/SSUUxKZUk9bFTEPNn_6Zo/YYPF65hr8MNSmKS2V0A4w_image.png)
8. Click **Finish** to close the dialog.

   ![](https://api.archbee.com/api/optimize/SSUUxKZUk9bFTEPNn_6Zo/5wl7JkNr-YuNrQcKg-MJ0_image.png)

:::hint{type="info"}
**Caution:** Syncing CA certificates restarts the device management service on each device. This takes approximately 30 seconds per device and causes a brief interruption to connectors during restart.
:::

## Verify CA certificate sync

To confirm that your certificates have been successfully synced to your devices:

In the **Instance CA sync** column, confirm that the status for each target device no longer shows **Not Synced**.

::Image[]{src="https://api.archbee.com/api/optimize/SSUUxKZUk9bFTEPNn_6Zo/vLSb32h7oxTYxjNwx1thg_image.png" size="80" width="1714" height="511" position="flex-start" darkWidth="1714" darkHeight="511" showCaption="false"}

The following statuses may appear during and after a sync:

| **Status**      | **Description**                                                             |
| --------------- | --------------------------------------------------------------------------- |
| **Pending**     | A sync has been triggered and is queued.                                    |
| **In Progress** | The sync is running on this device.                                         |
| **Failed**      | The sync failed. Retry by selecting the device and clicking **Sync** again. |

## Related topics

- [CA Certificates](docId\:wNTbbc0Rakl30ieGnt6iB)
- [Certificates](docId:3ZQZMfyTReqHGVkDPIBWU)