Certificate Authority

Hi

my mail server based on Debian ,web mail  running on apache.for now webmail  using self sign ca generated during mail server instalation wizards

i want to generate ca's for web mail (for LAN zone only) from sophos UTM Certificate  Authority.from WAN to WAF i am using real ssl ca for  webmail,but for lan use i want to use ca's generated from sophos local certificate authority

i created CSR and private key  in my mail server with openssl tool. how to upload CSR to sophos UTM and generate the certificate ?and after creating ca  how can i downloat ca an bundle-ca .

thanks