> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Configure a Trusted CA

Devices, such as a phone or a laptop, may include a device certificate to identify the device. This certificate can be used for device verification. For example, in a laptop there is a certificate that identifies both you and the laptop. That certificate is issued by a Certificate Authority. For the device to be trusted, you need to upload the CA certificate that issued the device certificate as a Trusted CA.

For information about Entrust PKI products that can support certificate issuance and management, see [Entrust PKI](https://www.entrust.com/products/pki).

### Configure a Trusted CA

1. Click Menu icon **>** **Resources** **> Certificate Authorities**. The **Certificate Authorities** page appears.

2. Click **Trusted Certificate Authority**. The **Trusted Certificate Authority** page appears.

3. Click Circle Plus icon. The **Add Trusted Certificate** dialog box appears.

4. Enter a **Name** for the Trusted CA.

5. Select the **State** of the certificate. You can **Disable** a Trusted CA if you no longer want it to be used for device certificate verification.

6. Click Arrow Up From Line icon next to **Upload Certificate** and browse to **select** your .p7b or your .cer CA certificate file.

7. If required, click Arrow Up From Line icon and browse to select **Additional Certificates**.

   This step is required if in the previous step you uploaded only the CA certificate file. If you only uploaded the CA file, you need to upload all intermediate CA certificate files up to the root CA certificate.

8. Optional. Select **Use as User Certificate CA** if you want to enable User Certificate authentication for first-factor (passwordless) or second-factor authentication.

9. Optional. Select **Enable Revocation Checking** if you want to be able to revoke the certificate.

10. Optional. Enter the **OCSP Responder URL Location**.

11. Optional. Click Arrow Up From Line icon and browse to select the **OCSP Responder Certificate**.

info
**OCSP Responder Location** and **OCSP Responder Certificate** are both optional. The OCSP responder location is used only if the certificate does not include the Authority Information Access (AIA) extension. The OCSP responder certificate is used only if provided and if the responder signs the response and the signature requires verification.

    IDaaS supports public OCSP responders and public HTTP CRL distribution points defined in the certificate.

12. Click **Add**. The CA is added to the **Trusted Certificate Authority** page.

13. If required, on the **Trusted Certificate Authority** page, click Refresh CW icon to include the existing Issuing CAs as trusted CAs that can also be used for device certificate authentication.