Additional ACME requirements for private on-premises DigiCert ONE users
Users with a private on-premises DigiCert ONE deployment need to install the PEM-encoded chain CA certificate — the bundle of root and intermediate CA certificates for the private TLS certificate that protects your DigiCert ONE instance — into the local trust stores of any systems that will use third-party ACME clients to manage certificates from Trust Lifecycle Manager.
This page includes basic instructions for how to meet these private trust requirements. For more details about how to install and manage the CA certificates in a local trust store, consult the documentation for your operating system version.
Importante
These requirements only apply to users with a local on-premises instance of DigiCert ONE. They do not apply to users of the cloud-hosted DigiCert ONE service.
Windows trust store requirements
To automate certificates on a Windows system via a private on-premises DigiCert ONE server, install the chain CA certificate for your local DigiCert ONE instance's TLS certificate into the Windows trust stores as follows:
Active Directory deployment
Refer to this page on the Microsoft website for instructions about how to distribute CA certificates via Active Directory.
Standalone deployment
To install the chain CA certificate for your local DigiCert ONE instance on a standalone Windows system:
Copy the private chain CA certificate to the Windows system as a PEM-encoded file (.crt file extension). Note the certificate file location.
Launch the Windows
certlm.msctool as an administrator to manage the certificates on the local machine.Use the Import action to browse and import the chain CA certificate file into both of the following trust stores:
Trusted Root Certification Authorities > Certificates
Intermediate Certification Authorities > Certificates
Linux trust store requirements
To automate certificates on a Linux system via a private on-premises DigiCert ONE server, install the chain CA certificate for your local DigiCert ONE instance's TLS certificate into the Linux trust store as follows:
Make sure the Linux ca-certificates package is installed. Install it if needed, for example, by running
apt-get install ca-certificatesoryum install ca-certificatesas root.Copy the private chain CA certificate to the Linux system as a PEM-encoded file (.crt file extension). Note the certificate file location.
Copy the .crt file for the chain CA certificate into the CA certificates directory. Then run the command as root to update the local trust store based on the current CA certificate files.
Your Linux distribution and version determines the CA certificates directory location and command to run. The following table lists some examples.
Linux distribution | CA certificates directory | Command to update trust store |
|---|---|---|
CentOS/RHEL | /etc/pki/ca-trust/source/anchors/ | |
SUSE | /usr/share/pki/trust/anchors/ | |
Ubuntu | /usr/local/share/ca-certificates/ | |