After Creating an intermediate Certificate Authority or Creating an issuing Certificate Authority, follow the steps below if the parent CA is a root external CA.

To certify a CA with an external root CA

  1. Open the following URL in a Web browser. 

    https://<machine>/management-console

    Where <machine> is the IP address or domain name of the machine hosting Cryptographic Security Platform.

  2. Log in to the Management Console as one of the users created in Creating Certificate Authority tenants. 
  3. In the content pane, click Manage Solution under Certificate Authority (CA).
  4. Select Operations in the sidebar.
  5. Under Organizations list, select the organization to which the intermediate or issuing CA belongs. 
  6. In the CA grid, select the name of the intermediate or issuing CA.
  7. Click Download CSR in the Edit Certificate Authority dialog.
  8. Use the external CA to process the downloaded certificate signing request and issue the certificate. Make sure this certificate meets the RFC5280 requirements – for example: 
    • The certificate includes the Basic Constraints extension with the ca boolean set to TRUE.
    • The certificate includes the Key Usage extension with the keyCertSign bit set.
    • The certificate includes other enabled bits, such as cRLSign for signing Certificate Revocation Lists (CRLs).
  9. Click Upload Certificate.
  10. Paste the Base64 encoding of the issued certificate.
  11. Click Submit.