Red Hat CERTIFICATE SYSTEM 7.2 - ADMINISTRATION Administration Manual page 243

b. Select the type of certificate to install. The options for the drop-down menu are the same
options available for creating a certificate, depending on the type of subsystem, with the
additional option to install a cross-pair certificate.
c. Paste in the certificate body, including the -----BEGIN CERTIFICATE----- and -----
END CERTIFICATE-----, into the text area, or specify the absolute file location; this must
be a local file.
The certificate will look like the following:
-----BEGIN CERTIFICATE-----
MIICKzCCAZSgAwIBAgIBAzANgkqkiG9w0BAQQFADA3MQswCQYDVQQGEw
JVUzERMA8GA1UEChMITmV0c2NhcGUxFTATBgNVBAsTDFN1cHJpeWEncy
BDQTAeFw05NzEwMTgwMTM2MjVaFw05OTEwMTgwMTM2MjVaMEgxCzAJBg
NVBAYTAlVTMREwDwYDVQQKEwhOZXRzY2FwZTENMAsGA1UECxMEUHawcz
EXMBUGA1UEAxMOU3Vwcml5YSBTaGV0dHkwgZ8wDQYJKoZIhdfNAQEBBQ
ADgY0AMIGJAoGBAMr6eZiPGfjX3uRJgEjmKiqG7SdATYzBcABu1AVyd7
chRFOGD3wNktbf6hRo6EAmM5R1Askzf8AW7LiQZBcrXpc0k4du+2j6xJ
u2MPm8WKuMOTuvzpo+SGXelmHVChEqooCwfdiZywyZNmgaMa2MS6pUkf
QVAgMBAAGjNjA0MBEGCWCGSAGG+EIBAQQEAwIAgD
-----END CERTIFICATE-----
5. The wizard displays the certificate details. Review the fingerprint to make sure this is the correct
certificate, or use the Back button to go back and submit a different one. Give a nickname for the
certificate.
The wizard installs the certificate.
6. Any CA that signed the certificate must be trusted by the subsystem. Make sure that this CA's
certificate exists in the subsystem's certificate database (internal or external) and that it is trusted.
If the CA certificate is not listed, add the certificate to the certificate database as a trusted CA.
If the CA's certificate is listed but untrusted, change the trust setting to trusted, as shown in
Section 10.4.4, "Changing the Trust Settings of a CA
When installing a certificate issued by a CA that is not stored in the Certificate System certificate
database, add that CA's certificate chain to the database. To add the CA chain to the database,
copy the CA chain to a text file, start the wizard again, and install the CA chain.
10.4.1.2. Installing Certificates Using certutil
To install subsystem certificates in the Certificate System instance's security databases using
certutil, do the following:
1. Open the subsystem's security database directory.
cd /var/lib/instance_ID/alias
2. Run the certutil command with the -A to add the certificate and -i pointing to the file
containing the certificate issued by the CA.
Installing Certificates in the Certificate System Database
Certificate".
223