---
title: CA Certificates
slug: edgemanager/lem-administrator-guide/configure-platform-settings/ca-certificates
docTags: 
createdAt: 2026-06-07T23:11:18.590Z
---

Edge device connectors verify secure connections by checking whether the certificate presented by the remote service was signed by a trusted Certificate Authority (CA). By default, devices only trust well-known public CAs. In certain enterprise networks, security infrastructure such as Deep Packet Inspection (DPI) appliances and SSL proxies intercept and resign traffic using internal or private CAs which edge devices don't recognize. This can cause TLS handshake failures and broken connector connections.

Custom CA certificate management lets you upload your organization's internal CA certificates to Litmus Edge Manager. LEM deploys them to connected edge devices, where connectors automatically append them to the system trust store. This allows connectors (including the MQTT SSL connector) to establish secure connections through your enterprise security infrastructure without manual certificate work on each device. Newly activated devices receive the current CA bundle automatically during provisioning.

:::hint{type="info"}
**Note**: CA Certificate Management is available for Litmus Edge Manager version 2.34.0 and later.
:::

# Access CA Certificates UI

**To access CA Certificates UI:**

In the Litmus Edge Manager Admin Console, select **Edge Devices** > **CA Certificates**.



::Image[]{src="https://api.archbee.com/api/optimize/SSUUxKZUk9bFTEPNn_6Zo/1FkUdVoC-KawOzH6da1AO_image.png" size="80" width="1916" height="525" position="flex-start" darkWidth="1916" darkHeight="525" showCaption="false"}

The *CA Certificates* pane lists all uploaded certificates with the following details:

| **Column**      | **Description**                                                    |
| --------------- | ------------------------------------------------------------------ |
| **Subject**     | The entity the certificate was issued to                           |
| **Issuer**      | The Certificate Authority that issued the certificate              |
| **Issued On**   | The date the certificate was issued                                |
| **Expiry Date** | The date the certificate expires, and the number of days remaining |
| **Fingerprint** | A short identifier for the certificate                             |
| **Actions**     | Options to manage the certificate                                  |

# Upload a CA certificate

**To upload a CA certificate:**

1. Click the Upload CA Certificate **+** icon.
2. In the *Upload CA Certificate* dialog, click **Choose**. Navigate to and select a certificate file in `.pem`, `.crt` , or `.cer` format.
3. Verify certificate information and click **Confirm Upload**.


   ::Image[]{src="https://api.archbee.com/api/optimize/SSUUxKZUk9bFTEPNn_6Zo/QlyRAjFabDStlG7v0sKIv_image.png" size="80" width="1156" height="343" position="flex-start" darkWidth="1156" darkHeight="343" showCaption="false"}

The certificate appears in the CA certificates list and is queued for deployment to connected edge devices.

# Sync certificates to edge devices

After uploading a certificate, you must sync it to your edge devices to distribute the updated CA bundle. Syncing is managed at the project level from the User UI. See [Certificates](docId:3ZQZMfyTReqHGVkDPIBWU) for more information.

# Delete a CA certificate

**To delete a CA certificate:**

1. In the CA certificates list, click the **Actions** icon for the certificate you want to remove.
2. Select **Delete**.
3. Click **Delete **in the confirmation dialog.

The certificate is removed from the pool.