I’m transitioning all of my local network services toward using an internal CA, but AdvancedTomato is a little trickier in that regard because it doesn’t have support for loading a custom cert or key in the web UI.
Instead, you must connect over SSH and modify the certificate files manually, then write them to nvram. Simply upload cert.pem and key.pem to the root home directory, then save this shell script:
cp ./cert.pem /etc/cert.pem
cp ./key.pem /etc/key.pem
sed -i "/END CERTIFICATE/q"...