Skip to main content

Create a trust bundle

From the Inventory > Trust stores page, you can create a trust bundle to define a trust policy and configure trust enforcement for your environment.

To create a trust bundle:

  1. In the Trust Lifecycle Manager menu, go to Inventory > Trust stores.

  2. Select Create trust bundle.

  3. On the Create trust bundle page, enter a Trust bundle name.

  4. (Optional) Enter a Description for the trust bundle.

  5. (Optional) From the Business unit dropdown, select a business unit. If the required business unit is not available, select Add business unit.

  6. In the CA certificate policy section, assign a policy to the required CA certificates:

    • Included: Include the CA certificate in trust stores provisioned with this trust bundle.

    • Excluded: Exclude the CA certificate from trust stores provisioned with this trust bundle.

    • Unassigned: This option is enabled after you select Included or Excluded for a CA certificate. Use it to clear the previous selection for that CA certificate.

    Note

    • You can use the Included, Excluded, and Unassigned tabs to view CA certificates by their assigned policy.

    • You only need to assign a policy to CA certificates that you want to explicitly include or exclude. CA certificates left unassigned are not managed by the trust bundle.

  7. (Optional) To assign the same policy to multiple CA certificates:

    1. Select the checkboxes for the required CA certificates.

    2. Select Included, Excluded, or Unassigned from the bulk actions displayed above the table.

  8. In the Trust enforcement for other certificates section, configure the trust enforcement policy.

    • Flexible (default): Leave the Strict checkbox unselected to use Flexible enforcement, which is the default policy. This allows CA certificates that are not included in the trust bundle unless they are explicitly excluded.

    • Strict: Select the Strict checkbox to allow only CA certificates included in the trust bundle. The DigiCert agent monitors provisioned trust stores and removes CA certificates that are not included in the trust bundle.

      Note

      When you select Strict:

      • CA certificates cannot be assigned as Excluded.

      • Any existing Excluded selections are cleared.

      • The Excluded count changes to zero (0).

      • The Excluded action becomes unavailable.

  9. In the Strict enforcement policy dialog, review the information, and then select Close to continue. To learn more about system trust stores where Strict enforcement is not supported, select System trust stores link.

  10. Select Preview to review the trust bundle configuration.

  11. On the Preview trust bundle page, review the trust bundle configuration, including:

    • Trust bundle details: Trust bundle name, description, business unit, and trust enforcement policy.

    • Included CA certificates: CA certificates that are included in trust stores provisioned from the trust bundle

    • Trust exclusions: CA certificates that are excluded from trust stores provisioned from the trust bundle. This section appears for Flexible enforcement.

      Note

      The Trust exclusions section is not displayed for trust bundles using Strict enforcement.

  12. If the trust bundle uses Strict enforcement, select I agree to create this trust bundle with Strict enforcement checkbox to confirm that you want to proceed.

  13. Select Create to create the trust bundle.

: