Replace the self-signed certificate on every box you log into

Start with the hardware you own

This is the shortest way through. Each page is built around the equipment itself — the appliances it covers, the hostnames they present, and the certificate that fits, with prices you can act on rather than enquire about.

• Firewalls, VPN & routers FortiGate, SonicWall, Palo Alto, pfSense, Cisco ASA Two surfaces need covering: the console your team logs into, and the SSL-VPN portal your remote staff hit every morning. Fix the portal first — a warning there is what teaches people to click through warnings everywhere else. See the certificates and prices →
• Voice: PBX, UCM & SBC Cisco UCM, 3CX, FreePBX, session border controllers A voice platform is five or six hostnames pretending to be one system. Cisco UCM alone answers as the publisher, each subscriber, presence and voicemail — so plan for more names than you expect. See the certificates and prices →
• Mail servers & webmail Exchange, autodiscover, Zimbra, smtp, imap Outlook asks for autodiscover before it asks for anything else. Cover mail but not autodiscover and every desktop in the building prompts on Monday morning, until somebody notices why. See the certificates and prices →
• Intranet & internal apps Staff portals, Jira, GitLab, dashboards, RDS Internal does not mean exempt any more — browsers give a self-signed intranet the full interstitial. These almost always sit under one company domain, which makes a wildcard the obvious answer. See the certificates and prices →
• NAS, hypervisor & consoles Synology, QNAP, VMware, Proxmox, iLO, iDRAC Individually low-traffic, collectively the biggest source of certificate warnings in most organisations — and they hold your data and your out-of-band access. One wildcard usually clears the rack. See the certificates and prices →
• Web & app servers IIS, Apache, Nginx, Tomcat, load balancers The software does not care which brand you buy, only that the chain is complete and the key matches. What changes is how much the certificate says about your company, and how many names it covers. See the certificates and prices →

Already know your hostname list?

Then skip the hardware pages. Every estate is one of these four shapes, and the only two questions that decide it are how many hostnames you need on the certificate and whether your company name has to appear inside it.

What the self-signed certificate is actually costing you

Not an abstraction. These are the four things that go wrong, in the order people usually notice them.

• Your team learns to click through warnings Once staff accept a warning on the firewall every morning, they accept the one on a phishing page too. This is the expensive one, and it is invisible until it is not.
• Things stop working, quietly Mail clients drop connections, VPN clients refuse to launch, mobile apps fail to sync, API integrations time out. None of it says “certificate” in the error, so it gets debugged as something else for a day first.
• It comes up in every audit and questionnaire Self-signed certificates on management interfaces are a standing finding in ISO 27001 and PCI reviews, and a standard question on customer security questionnaires.
• You cannot tell a real problem from the usual noise When a device warns permanently, a genuine interception or an expired chain looks exactly like Tuesday. A clean estate makes the one real warning visible.

How the install actually goes

Three steps on almost every appliance, and the same three whether it is a FortiGate or a Synology.

1. Generate the request on the device Nearly every appliance will create the signing request itself and keep the private key on the box, which is safer than moving a key around. Where one cannot, our free CSR generator makes the request and gives you the matching key.
2. Order and validate Paste the request in at checkout. Domain validation is an email or a DNS record and takes minutes; organisation validation adds a company check of one to three working days.
3. Upload the certificate and its chain This is where appliance installs go wrong. Browsers forgive a missing intermediate; phone handsets, VPN clients and mail clients do not. Confirm it from outside with the SSL checker, and if a certificate and key will not pair, the key matcher says why in seconds.

Questions we get asked before people order