Adding an external root CA
If you want to leverage PKIaaS issuing CAs while maintaining the root of trust within your organization, PKIaaS allows you to sign an issuing CA using a non-PKIaaS root CA you owned.
For this use case, you must add your external root CA certificate in ECS Enterprise before adding an issuing CA (as explained in Adding an issuing CA under an external root CA).
To add an external root CA
Navigate to Administration > PKIaaS Management.
In the side pane, click Add Private CA.
In Select CA, choose External Root Certificate Authority, and click Next.
Click Next to display the CA Information form.
Enter the following information.
Click Next to review the external root CA information.
Click Submit.
When the CA creation completes, check the CA details in the CA grid view.
Refresh the grid. You will notice that the status changes to Active.
Friendly Name
Enter an informal name for the new CA.
Mandatory: Yes.
Self-Signed Root Certificate
Paste the base64-encoded (PEM) self-signed root CA certificate.
Mandatory: Yes.
Region
Select the region in which the CA will be hosted.
The region of the root CA decides the region of the issuing CA.
Mandatory: Yes.