---
title: Manage Certificates with DigiCert IoT Trust Manager Integration
slug: bhdm/manage-certificates-with-digicert-iot-trust-manager-integration
createdAt: 2025-01-10T19:04:13.350Z
---

:::hint{type="info"}
**Note**: The DigiCert IoT Trust Manager integration is available for Belden Horizon Data Manager 2.21.0 and later.
:::

In this use case, you will integrate DigiCert IoT Trust Manager to manage certificates for all your edge devices. 

- First, you will set up the DigiCert IoT Trust Manager Integration from your Belden Horizon Data Manager (BHDM) Admin Console. 
- Then, you will configure the Certificate Authority (CA) for both BHDM and Edge devices. 
- Finally, you will verify if the DigiCert certificates are applied to your BHDO devices.

# Before You Begin

- Ensure you have at least one Edge device activated in your BHDM. See [Activate an Edge Device](docId\:bbgh94p0zHJUZ0JuaO6bY)  for more information.
- Ensure you have access to the DigiCert IoT Trust Manager to obtain the required configuration parameters. If you are not a DigiCert IoT Trust Manager customer, visit [https://www.digicert.com/device-trust-manager](https://www.digicert.com/device-trust-manager) to sign up. 

# Step 1: Access DigiCert IoT Trust Manager Integration 

**To access the DigiCert IoT Trust Manager integration pane: **

1. Log in to the BHDM Admin Console at the following URL: **https\://\[BHDM IP address]:8446**.
2. From the Navigation panel, select **Integration**.
   Integration's *Kafka* pane by default appears.
3. From Integration's navigation sub-panel, select **DigiCert**.
   Integration's *DigiCert *pane appears.

   ::Image[]{src="https://api.archbee.com/api/optimize/vAqK-046vdh4I0e1y9cfX/72Dj-cZZwk039aL43bKWw_image.png" size="80" width="1261" height="565" position="center" caption="DigiCert pane" showCaption="true"}

You will see three fields for configuration: **URL**, **Profile ID**, and **Passcode**. By default, placeholder values will be in these fields. In the next step, you will retrieve these configuration parameters from the DigiCert IoT Trust Manager.

# Step 2: Set up Integration with DigiCert

**To retrieve the URL, Profile ID, and Passcode parameters from the DigiCert IoT Trust Manager, follow the steps below:**

1. Open a new browser and log in to your **DigiCert ONE **platform at [https://one.digicert.com.](https://one.digicert.com/)
2. Select *IoT Trust Manager* from the switcher icon at the top right corner. 
3. From the navigation panel, select **Enrollment configurations**.
   The *Enrollment profiles* page opens.
4. Click the desired **Enrollment profile name**. The *Enrollment profile details* page appears.
   **Note:** 
   1\. For this use case, the enrollment profile is already created. See [Create an enrollment profile](https://docs.digicert.com/en/iot-trust-manager/enrollment-profiles/create-enrollment-profiles/create-an-enrollment-profile.html) to learn more. 
   2\. Set up the enrollment profile method for REST API, as it is the integrated method with BHDM.

   ![](https://api.archbee.com/api/optimize/SSUUxKZUk9bFTEPNn_6Zo/D4IJni9R3iq1c6on2uuwF_image.png)

   ::Image[]{src="https://api.archbee.com/api/optimize/SSUUxKZUk9bFTEPNn_6Zo/0_-JVj8Bz-mOG1qsASbjr_image.png" size="60" width="771" height="458" position="center" caption="Certificate enrollment methods dialog box" showCaption="true"}
5. Configure the keypair generation settings to be used.

   ::Image[]{src="https://api.archbee.com/api/optimize/SSUUxKZUk9bFTEPNn_6Zo/qMr3rarFgo9vS1zmp3wY2_image.png" size="60" width="690" height="324" position="center" caption="Keypair generation settings" showCaption="true"}
6. After creating the Enrollment Profile, edit the enrollment profile. Scroll to the bottom of the Enrollment Profile details page and create a passcode. 
   Copy and save this passcode to a secure location. 
   See also [Enrollment Passcodes](https://docs.digicert.com/en/iot-trust-manager/enrollment-passcodes.html) to generate the passcode for authenticating to the REST API. 
7. You can retrieve the *URL*, *Profile ID*, and *Passcode* parameters from the *Enrollment profile details* page as follows:
   - **URL:** This is the DigiCert server URL. Navigate to *API *section and copy **Request URL** link.

     ![](https://api.archbee.com/api/optimize/SSUUxKZUk9bFTEPNn_6Zo/y7za2LNooaM6FjE6gUfdS_image.png "Enrollment profile details page - API section")
   - **Profile ID: **Copy this from the *Enrollment profile ID*.

     ![](https://api.archbee.com/api/optimize/SSUUxKZUk9bFTEPNn_6Zo/xtJeJ4zAPemP3eAdzaUwr_image.png "Enrollment profile details page")
   - **Passcode:** This was generated and shown when you created the passcode above. 
8. Enter the retrieved parameters into the *DigiCert *Integration fields in the BHDM Admin Console.
9. Click **Save**.
   A confirmation message will appear indicating that the DigiCert settings are saved.

   ![](https://api.archbee.com/api/optimize/vAqK-046vdh4I0e1y9cfX/JZp0EWVHejtl6JiDzvVFP_image.png "DigiCert Integration Page")

# Step 3: Set up Certificate Authority for BHDM

**To set up the certificate authority for BHDM:**

1. From the BHDM Admin Console, navigate to **Settings **>** Domain/SSL**.
2. From the *SSL settings *pane, choose the **DigiCert **option.

   ![](https://api.archbee.com/api/optimize/vAqK-046vdh4I0e1y9cfX/uET6OsOgTwJtfKVXEZM3__image.png "SSL settings pane")
3. Click **Save**.
4. The *Page Reload Required* dialog box appears. Click **Yes, **and refresh the page.
   SSL settings are saved and the page is reloaded after updating the certificate settings for proper system functioning.

# Step 4: Issue a certificate for BHDO Device from BHDM User UI

**To issue a certificate for BHDO Device from BHDM User UI:**

1. Log in to BHDM and navigate to **Certificates **tab.
   The list of current certificates for your edge devices along with their details appears.

   ![](https://api.archbee.com/api/optimize/vAqK-046vdh4I0e1y9cfX/l1UW4vO0ZqK9V_bvo0AqF_image.png "Certificates tab")
2. To issue a new certificate, click the **Action **button for an edge device and select** Issue a new certificate**.

   ![](https://api.archbee.com/api/optimize/vAqK-046vdh4I0e1y9cfX/zDINjoT1smRNS2hVceNl2_image.png "Certificates Management pane")
3. From the *Issue a new certificate *dialog box, configure the following:
   - **Certificate Authority:** From the dropdown menu, select **DigiCert IoT Trust Manager **as the new certificate authority.
   - (Optional) Keep default settings for the other fields.
4. Click **ISSUE CERTIFICATE**. 

   ::Image[]{src="https://api.archbee.com/api/optimize/vAqK-046vdh4I0e1y9cfX/PTJpRso75kon6lbZVkB76_image.png" size="50" width="757" height="758" position="center" caption="Issue a new certificate dialog box" showCaption="true"}

The certificate has been added to the BHDO device along with the issuer details.

# Step 5: Verify Certificate for BHDO Device

**To verify that the certificate has been added to the BHDO device:**

1. Navigate to the specific edge device instance where you applied the certificate and log in.
2. Go to **Systems **> **Network **and find the *Device Certificates* panel.

   ![](https://api.archbee.com/api/optimize/vAqK-046vdh4I0e1y9cfX/nXcySedc3jm9m_1EiowFa_image.png "Systems > Network  page")

You can verify the certificate details and ensure that the new certificate has been added.

:::hint{type="info"}
**Note:** Refresh the screen if necessary to see the updated certificate and issuer details. Reboot is required to see the certificate update on browser tab. 
:::