Importing the CA's Root Certificate

Browsers typically come with certificates for well-known CAs already installed, and you rarely need to install them. If you need a CA's root certificate, you can typically download it from the CA's website.

CAs typically use both "root" and "intermediate" certificates. Entity certificates, such as server, client, and user certificates, are signed by an intermediate certificate. Intermediate certificates are signed by other intermediate certificates or a root certificate. The entity, intermediates, and root form a "chain" of certificates that ends in a trusted root certificate. While clients and servers will sometimes send the necessary intermediate certificates along with their entity certificate, for best interoperability you should import both root and intermediate certificates into your collection of trusted certificates.

The demonstration CA uses a root and a single intermediate certificate. These can be found in the file entities/CAs/EC_CAcollection.p7b under the Demo CA location. The "EC" prefix indicates these are ECC, or Elliptic Curve Cryptography, certificates. There is another version of this file in a different format with the .pem file extension. The .p7b file is in PKCS#7 format, which more browsers support. This is the file you will import into your collection of trusted certificates.

The import process differs between browsers. In particular, some browsers have their own collection of trusted certificates, and others use one maintained by the operating system. In either case, you can usually get to a wizard or other tool for importing trusted certificates from your browser's Settings page, typically under a Security tab or similar.

Typically, to import the certificates:

  1. Locate the certificate import function for your browser.
  2. Select the file EC_CAcollection.p7b from your Demo CA instance.
  3. Confirm the browser will import these certificates as trusted roots.
    Note: Different browsers use different terms for this.
  4. After importing, you can view your browser's trusted roots and confirm the Demo CA root is present. The Demo CA root has a common name like "Demo CA on host", where host is the hostname of the system where Demo CA was executed.