> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Configure an Entrust Managed PKI certificate authority (CA)

This procedure outlines how to configure an Entrust Managed PKI. Before you begin, obtain a certificate file from Entrust. You need the .EPF file when you configure the CA in Identity as a Service. You need both an XAP EPF and a PIV EPF.

## Configure an Entrust Managed PKI CA

1. Click Menu icon **>** **Resources** **> Certificate Authorities**. The **Certificate Authorities** page appears.

2. Click **Issuing Certificate Authority** and then select **Entrust Managed PKI CA** from the drop-down list.

3. Configure the **Connection Settings**. This section contains the information needed to connect the CA with your Identity as a Service account.

   1. Enter a **Name** for your certificate authority.

   2. In the **PKI Host** field enter the fully qualified domain name of the computer hosting the PKI.

   3. Enter the **PKI CMP Port** number of the host running the PKI CMP service. This is the port used to request certificate information. The default is 829.

   4. Enter the **XAP Port** number of the host running the XAP service. All CAs on Identity as a Service must connect to an XAP service to perform administrative operations. The default is 1443.

   note
   XAP is used for administrative operations, such as modeling a user in the CA and setting them up for a digital ID creation or recovery.

   5. Click Arrow Up From Line icon and select the `.epf` capable of performing XAP operations. The XAP EPF contains administrative credentials for the CA being created.

   6. Enter the **XAP EPF Password**.

4. Configure the **PIV Content Signer Settings** for the certificate authority. These settings define how the smart credential PIV applet information is signed by the CA.

   1. The default **PIV Content Signer Algorithm** type is **RSA RECOMMENDED NO SHA224**. Do not change this setting unless you are sure of the setting you need, and why you need it.
   2. If the managed CA is used to issue PIV smart credentials, click Arrow Up From Line icon and navigate to the .epf of an administrator capable of performing PIV signing operations.
   3. Enter the **PIV EPF Password**.

   The PIV Content Signer DN is entered automatically after you upload the certificate.

5. Configure the **LDAP Configuration** settings. The LDAP configuration settings contain information required to access the certificate revocation list (CRL). The CRL is checked by Identity as a Service at every log in attempt to confirm that the certificate being used has not been revoked.

   1. In the **LDAP Host** field, enter the fully qualified host name of the computer hosting the LDAP directory.
   2. In the **LDAP Port** field, enter the LDAP port number used to connect to the LDAP directory.
   3. Click **Use SSL** to secure your LDAP directory (LDAPS) and optionally, enter your directory **Username** and **Password**. The credentials should be the account that only has read only access to the underlying Active Directory.

6. Configure the **Other Settings**, as required:

   1. Select **Immediately Publish CRL Upon Revocation** if you want to immediately publish a new CRL immediately after an operation. If deselected, the CRL publishes every 24 hours.
   2. The **Revocation Cache Timeout (min)** **is** the number of minutes Identity as a Service should cache the revocation information of a CA before refreshing the information. The default is 120 minutes.
   3. Select **Skip Revocation If CA Not Available** to allow Identity as a Service to delete or disable a smart credential if revocation fails. If deselected, the delete or disable operation fails if certificate revocation fails.
   4. Select **Use as a Trusted CA for Device Verification** to use this CA as a trusted CA for device verification.

7. Configure the **Digital ID Configurations** as follows:

   1. Enter the **Searchbase** of the digital ID configuration. The searchbase value is listed in the CA you downloaded from Entrust.

   2. Click **Add**. The **Add Digital ID Configuration** dialog box appears.

   3. From the **Configuration Template** drop-down list, select the type of configuration template associated with the searchbase listed in your CA. The template associated with the searchbase is also listed in the CA you downloaded from Entrust.

   note
   **Note**: You may require more than one template depending on how you are using the smart credential.

   For smart credential push authentication, you require the following configuration templates. You must add each one individually.

   - PIV Card (identifies the card)
   - PIV Cardholder (identifies the user)
   4. Click **Add**. The configuration appears in a list of **Digital ID configurations**.

   5. Repeat steps **b** to **d** to add the remaining configuration templates.

   6. Click **Save**. The CA appears on the **Certificate Authorities** page.

## Edit or Delete the CA

If you need to make changes to the CA, you can edit it as follows:

1. On the **Certificate Authorities** page, click the **Name** of the CA. The **Edit Certificate Authorities** page appears.
2. Using the information in the procedure to configure a CA, edit the CA as required and click **Save**.

To delete a CA, click Trash icon next the CA you want to delete and click **Delete** on the confirmation prompt.