Working with Trusted CA Certificates¶

From the Trusted CA Certificates page in Certificate Manager - SaaS, System Administrators and PKI Administrators can add, download, and delete trusted certificates.

View Trusted CA certificates¶

1. Sign in to Certificate Manager - SaaS.
2. Click Inventory > Trusted CA Certificates.
3. In the left navigation pane, click the certificate you want to view. The details open in the right pane.

Add a trusted CA certificate using a Base64 encoded text file¶

1. Click Inventory > Trusted CA Certificates.
2. In the toolbar, click Add.

3. Using either the Paste Base64 encoded text or Upload files option, either paste or upload the certificates you want to add. You can upload up to 200 certificates at a time.

   Note

   The certificates must be encoded in Base64 format.

4. When you're done, click Add.

You'll see your new CA certificate in inventory and can download it.

How VSatellites use trusted CA certificates¶

Certificate Manager - SaaS synchronizes trusted CA certificates to your VSatellites automatically. Synchronization typically completes within one minute, and each VSatellite applies new trust anchors without a service restart.

VSatellites use these trust anchors to verify the TLS certificates that ACMEv2 servers present. If an internal or private CA issued the TLS certificate for your ACMEv2 server, add that CA's root certificate here before you add the custom ACMEv2 CA.

VSatellite version requirements¶

TLS certificate verification requires VSatellite version 2.0.30 or later. VSatellites update themselves, so you don't need to upgrade one manually. To see which version a VSatellite is running, click Configurations > VSatellites in Certificate Manager - SaaS. For details about what's included in each version, see the VSatellite release notes.

Whether verification is turned on depends on when you deployed the VSatellite:

• VSatellites deployed on or after 27 August 2026: Verification is turned on by default. These VSatellites verify the TLS certificate that an ACMEv2 server presents, and they use your trusted CA certificates to do it.

• VSatellites deployed before 27 August 2026: Verification is turned off. These VSatellites continue to work as they do today, ignoring the certificates in your trust store, until you turn verification on.

Turn TLS certificate verification on or off¶

To change the setting, run vsatctl on the VSatellite host.

This command requires vsatctl version 2.0.59 or later, which is when the --enable-trust-store flag was added. To check which version you have, run vsatctl version.

1. Download the latest version of vsatctl:

   curl -O https://dl.venafi.cloud/vsatctl
   chmod +x ./vsatctl
   

2. Turn verification on:

   sudo ./vsatctl update config --enable-trust-store=true
   

   Or turn it off:

   sudo ./vsatctl update config --enable-trust-store=false
   

For the full command reference, see vsatctl update config.

Download a Trusted CA certificate¶

1. Click Inventory > Trusted CA Certificates.

2. In the left navigation pane, click the certificate you want to download.

   Note

   You can only download one certificate at a time.

3. In the toolbar, click Download.

Delete a trusted CA certificate¶

1. Click Inventory > Trusted CA Certificates.
2. In the left navigation, click the certificate you want to delete. If you want to delete multiple certificates, click the checkbox next to each certificate you want to delete.
3. In the toolbar, click Delete.