---
title: "How to configure trusted CA to outside parties"
slug: "how-to-configure-trusted-ca-to-outside-parties-1"
updated: 2026-06-26T16:29:35Z
published: 2026-06-26T16:29:35Z
canonical: "support.fortanix.com/how-to-configure-trusted-ca-to-outside-parties-1"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to configure trusted CA to outside parties

To allow an SGX application to access outside services, we need the certificate authority (CA) public key. Each account has its certificate authority, so applications will have a different parent CA based on their respective accounts.

### How to obtain an account CA public key

High-level steps include:

- Log in to Fortanix Confidential Computing Manager (CCM)
- List accounts
- Select account
- List zones

This can be obtained using the em_cli tool or with direct REST calls.

1. Using em_cli:

```bash
# Install curl and jq
sudo apt update; sudo apt install curl jq

# Download em_curl.sh for em-cli
curl -LO https://github.com/fortanix/rust-sgx/raw/master/em-app/examples/scripts/em_curl.sh
source em_curl.sh

# Login to CCM with your email and password
em-cli user login 'https://ccm.fortanix.com' 'email@example.com' 'password'

# Show available accounts
em-cli user refresh
em-cli account list

# Select a specific account by acct_id
em-cli user refresh
em-cli account select 'UUID'

# Save zone certificate to a file
em-cli user refresh
em-cli zone list | jq '.[0].certificate' -r > zone_ca.pem
```
2. Using REST APIs:
  1. To log in to Fortanix CCM and select an account, refer to *Sections 3.1* through *3.3* in [*Using Fortanix Confidential Computing Manager to Build an Enclave OS Nginx Application*](/v1/docs/using-fortanix-confidential-computing-manager-to-build-an-enclave-os-nginx-appli)*.*
  2. Get the list of zones and save the zone certificate to a file:

```bash
curl -b $cpath -c $cpath -H "X-CSRF-Header:true" https://ccm.fortanix.com/v1/zones | jq '.[0].certificate' -r > zone_ca.pem
```

### How to configure external services

Services that support 'Trusted CA', for example, Fortanix-Data-Security-Manager (DSM), can be configured by copy-pasting the certificate obtained from the section above to the service and configuring a 'Common Name'.

![ConfigureTrustedCA.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360081907571.png)

**Figure 1: Adding trusted CA to Fortanix DSM**

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.

## Related

- [Migrating Private Key from Microsoft AD CS Certificate Authority to Fortanix DSM](/migrating-private-key-from-microsoft-ad-cs-certificate-authority-to-fortanix-dsm.md)