> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Edit a PKIaaS CA

Once you create the PIV Content Signer for a PKIaaS CA, you can edit the digital ID configurations.

To edit a PKIaaS CA:

1. Log in to your Identity as a Service administrator account.

2. Click Menu icon **>** **Resources > Certificate Authorities**. The **Certificate Authorities List** page appears.

3. Click the name of your PKIaaS CA. The **Edit Entrust PKIaaS Certificate Authority** page appears.

4. You can edit the following:

   - Name
   - Digital ID Configurations
   - PIV Content Signer Algorithm

5. To edit the digital ID configurations:

   1. Click the digital ID, for example, PIV Card. The **Edit Entrust PKIaaS Digital ID Configuration** page appears.
   2. Edit the following fields, as required:
      - Name
      - Searchbase
      - Select a new **Type** from the drop-down list. A smart credential can have two digital IDs:
        - PIV Card Holder
        - PIV Card
      - DN Format
   3. Deselect **Include Searchbase in DN** if you do not want to include the searchbase in the DN.

6. Add additional **Cert Templates**, as follows:

   1. Do one of the following:
      - Click **Add** to add a new certificate template. The **Add Cert Template** dialog box appears.
      - Click an exiting certificate template. The **Edit Cert Template** dialog box appears.
   2. From the **Type** drop-down list, select the type of certificate template defined in PKIaaS. The options include:
      - Piv Authentication
      - Card Authentication
      - Digital Signature
      - Key Management (encryption)
   3. From the **Key Type** drop-down list, select the key type of that matches the certificate container in the smart credential.
   4. Set the **Certificate Lifetime**, choosing one of the following options:
      - Select **Use CA Default Certificate Lifetime** to set the certificate template to expire when the default CA certificate expires.
      - Set the **Certificate Lifetime (months)** to set the lifetime of the CA certificate. The range is 0-100 months.
   5. Click **Add**.

7. Add additional **Subject Alt Names**. The `subjectAltName` extension can contain alternative names for the subject of the certificate. These entries in the Identity as a Service Digital ID list `subjectAltName` values that Identity as a Service sends to the CA so that they are included in the certificate. For example, the default template includes the user's email address and userPrincipalName.

   To add SubjectAltNames

   1. Click **Add** to add **Subject Alt Names**. The **Add Subject Alt Name** dialog box appears.
   2. From the **Type** drop-down list, select
   3. Enter a **Value**.
   4. Click **Add**.
   5. To delete a **Certificate Template**, click Trash icon next to the certificate template.

8. Click **Save**.