How do I get server certificates on Linux?

Use ACME. It's how Linux servers normally get certificates, and certbot, acme.sh and Caddy all work with Passbeam.

First make an ACME key: open the client, then Server certificates, then ACME, and click Add ACME key. You need the Directory URL, the Key ID and the HMAC key from there.

certbot with nginx:

$ sudo certbot --nginx --server <Directory URL> \    --eab-kid <Key ID> --eab-hmac-key <HMAC key> \    -d intranet.riverside.local

certbot's package sets up its own renewal timer, so there's nothing else to do.

acme.sh, if you want something small with no dependencies:

$ acme.sh --register-account --server <Directory URL> \    --eab-kid <Key ID> --eab-hmac-key <HMAC key>$ acme.sh --issue --server <Directory URL> -d intranet.riverside.local --standalone$ acme.sh --install-cert -d intranet.riverside.local --ecc \    --key-file /etc/ssl/private/intranet.key \    --fullchain-file /etc/ssl/certs/intranet.pem \    --reloadcmd "systemctl reload nginx"

Caddy gets and renews certificates itself. Put this at the top of your Caddyfile:

{    acme_ca <Directory URL>    acme_eab {        key_id <Key ID>        mac_key <HMAC key>    }} intranet.riverside.local {    reverse_proxy localhost:8080}

Passbeam doesn't ask for a challenge, so the server doesn't need to be reachable from the internet and port 80 doesn't need to be open.

Machines that connect to these sites, like other servers or scripts using curl, need to trust the client's Passbeam root. See Do servers and PCs outside Intune trust these certificates?