See below for adding an external root Certificate Authority (CA) – that is, a root Certificate Authority created outside the Certificate Authorities solution.

To add an external root Certificate Authority

1. Open the following URL in a Web browser. 

   https://<machine>/management-console

   Where <machine> is the IP address or domain name of the machine hosting Entrust PKI Hub.

2. Log in to the Management Console as one of the users created in Creating Certificate Authority tenants. This user will be the tenant of the new root external Certificate Authority.
3. In the content pane, click Manage Solution under Certificate Authority (CA).
   
4. Click the Operations sidebar command.
   
5. In the Organizations list, select an existing organization or select Create Organization to create one, as explained in Creating Certificate Authority organizations.
6. Click New.
   
7. Configure the following settings.
   • CA Type
   • CA ID
   • Self-Signed Root Certificate
8. Click Submit to create the new Certificate Authority.

CA Type

Click ​External Root Certificate Authority.

Mandatory: Yes.

CA ID

Type a unique identifier for the new Certificate Authority within its organization. This identifier:

• Must be 3-18 characters long.
• Can only include lowercase letters, numbers, underscores ("_"), and hyphens ("-").

Mandatory: Yes.

Self-Signed Root Certificate

Paste the PEM-encoded certificate signing certificate of the external CA – for example:

Mandatory: Yes.