> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Configure the Domain Controller to trust the issuing CA

You need to configure the domain controller to trust the Certificate Authority that issues the smart credential.

note

If the Identity as a Service Certificate Authority resides on the Domain Controller, then this step is not required.

To configure the domain controller to trust the issuing CA:

1. Export the CA trust chain:
   - For an Entrust Managed PKI Certificate Authority, see [Export an Entrust Managed PKI CA trust chain](/docs/authentication-and-security/manage-certificate-authorities/configure-an-entrust-managed-pki-ca/export-an-entrust-managed-pki-ca-trust-chain.md).
   - Microsoft Certificate Authorities not tied to the domain controller, see [Export a Microsoft CA trust chain](/docs/authentication-and-security/manage-certificate-authorities/configure-a-microsoft-ca/export-a-microsoft-ca-trust-chain.md).
   - For PKIaaS CA issued smart credentials, see [Configure domain controller certificates](/docs/authentication-and-security/configure-domain-controller-certificates.md).
2. Run the following commands on the domain controller to trust the CA

```powershell
certutil -f -dspublish trustedca.cer RootCA

certutil -f -dspublish intermediateca1.cer NTAuthCA

certutil -f -dspublish intermediateca1.cer SubCA

certutil -f -dspublish intermediateca2.cer NTAuthCA

certutil -f -dspublish intermediateca2.cer SubCA
```