@WillFG I’ve just checked the latest 9.0.3 CLI, and there I seem to be able to add device env vars by:
$ balena env add VARNAME value --device uuid
This seems to be adding to the device (ie. available for all services)
What version of the CLI are you trying?
I’ve asked our team about the SSL certificate error.