How to update balenaRootCA on already-provisioned devices without SSH (2026)?

Product support balenaOS
1

Goal: Update balenaRootCA on already-deployed, in-field devices programmatically, without SSH access so they can operate behind networks with MITM/SSL-inspecting firewalls (Cato, Zscaler, etc.).

Context: We’ve built a container that manages CA certificates on the device. The goal is a self-serve workflow: a client with their own managed network and inspecting firewall can upload their root CA through our own UI, without needing us to SSH in remotely for every site. That part works fine for our own container’s own trust store. The piece we’re stuck on is getting the host OS (and Cloudlink) to trust it too, so the device can still reach balenaCloud.

The actual question: Given all of that, is there a supported way to update balenaRootCA on an already-provisioned, already-deployed device remotely via the CLI, the balenaCloud API directly, or some dashboard path we’re missing without physically SSH-ing into each device? It’s a fair, ordinary networking maintenance task (certs rotate, sites change firewalls), so it seems like there should be a real, supported answer here that doesn’t require touching every device by hand.

Is there a way to set this as a device configuration variable? Or something in the supervisor api that’s not shown in the docs?

Thank You

2

Unfortunately, you’ve described a valid use case that we currently lack a remote solution for. The host OS balenaRootCA can only be edited directly on the boot partition through the config.json file. We haven’t exposed this property to the supervisor or device configuration variables.

We also advise against creating custom containers that attempt to write to the boot partition at runtime. Improperly done, this can leave the device in an unbootable state.

We’re currently exploring ways to safely expose more config.json properties to clients, but we don’t have any specifics to share yet.

In the meantime, the best I can recommend is opening a request on Feature Requests - balenaForums and see if it gets more traction. But we are already discussing all of the properties of that config file, not just the one in question.