---
title: Configuring a trusted certificate in PingDirectory
description: Configure a trusted certificate using components of PingDirectory such as the config directory and the dsconfig utility.
component: solution-guides
page_id: solution-guides:single_sign-on_use_cases:htg_config_sailpoint_identityiq_pd_pf_ldaps_cert
canonical_url: https://docs.pingidentity.com/solution-guides/single_sign-on_use_cases/htg_config_sailpoint_identityiq_pd_pf_ldaps_cert.html
llms_txt: https://docs.pingidentity.com/solution-guides/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: May 1, 2024
section_ids:
  about-this-task: About this task
  steps: Steps
  result: Result
---

# Configuring a trusted certificate in PingDirectory

Configure a trusted certificate using components of PingDirectory such as the `config` directory and the `dsconfig` utility.

## About this task

To configure a trusted certificate in PingDirectory, you must replace the default self-signed certificate in the keystore with the trusted certificate. You must ensure that the referenced certificate files are in PEM certificate format.

## Steps

1. On the PingDirectory server in the installed directory, execute the following command.

   ```
   bin/manage-certificates change-certificate-alias \
   > --keystore config/keystore \
   > --keystore-password-file config/keystore.pin \
   > --current-alias server-cert \
   > --new-alias server-cert-prev
   # Initializing the server's encryption framework...
   Successfully changed the alias from 'server-cert' to 'server-cert-prev'.
   ```

2. Import the new trusted certificate to the keystore with the server-cert alias.

   ```
   bin/manage-certificates import-certificate \
   > --keystore config/keystore \
   > --keystore-password-file config/keystore.pin \
   > --alias server-cert \
   > --private-key-file demo.ping-eng.key \
   > --certificate-file demo.ping-eng.pem \
   > --certificate-file intermediate.crt
   # Initializing the server's encryption framework...

   The following certificate chain will be imported into the keystore, along with
   a private key, into alias 'server-cert':

   < Certificate Displayed Here >

   Do you want to import this certificate chain into the keystore? yes
   Successfully imported the certificate chain and its associated private key.
   ```

## Result

The trusted certificate is installed for use by the PingDirectory LDAPS Listener. IdentityIQ can now connect to PingDirectory over LDAPS.