Add CA Certificates to the Client Trust Store
Certificates issued by PKI-as-a-Service are trusted only when the EC Root CA is in the trust store of the relying party. The Issuing CA certificate is added to the intermediate store so the chain builds without delay.
- Domain-joined Windows (Group Policy): GPO → Computer Configuration → Policies → Windows Settings → Security Settings → Public Key Policies. Command or location: Import the Root CA into Trusted Root Certification Authorities and the Issuing CA into Intermediate Certification Authorities.
- Domain-joined Windows (Active Directory): Publish to AD. Command or location:
certutil -dspublish -f RootCA.crt RootCAandcertutil -dspublish -f IssuingCA.crt SubCA. - Standalone Windows: Local machine store. Command or location:
certutil -addstore -f Root RootCA.crtandcertutil -addstore -f CA IssuingCA.crt. - macOS: System keychain. Command or location:
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain RootCA.crt. - Debian / Ubuntu: System CA bundle. Command or location: Copy the PEM file to /usr/local/share/ca-certificates/ and run
sudo update-ca-certificates. - RHEL / CentOS: System CA bundle. Command or location: Copy the PEM file to /etc/pki/ca-trust/source/anchors/ and run
sudo update-ca-trust. - Java applications: Java trust store. Command or location:
keytool -importcert -cacerts -alias pkiaas-root -file RootCA.crt. - Mobile devices: MDM. Command or location: Trusted certificate profile in Intune or Jamf.
Verification: on Windows, run certutil -verify -urlfetch <certificate>.cer. The chain must build to the EC Root CA and every CDP and AIA URL must show Verified.