Step 4: Import the RootCA as External CA in Node A

The PKI infrastructure implementation described in this guide includes an online and an offline EJBCA hardware appliance. Now that RootCA is set up, there is an option to install it on the online appliance. The reasons for this are:

The logical hierarchy when navigating to the Certification Authorities is easy to understand. There you can see that the SubCAs are installed locally, but also that there is a ROOTCA that has signed them, which indicates External CA. This means that it is installed in the offline EJBCA Hardware Appliance.
When CSRs are created and have to be signed by RootCA, no other import is needed (RootCAs certificate). The chain is auto generated.
When you do certificate enrollment from a CSR you just need to set PEM - Certificate only as Result type.

To import RootCA’s certificate in the EJBCA Hardware Appliance that is online, proceed as follows:

Go to the EJBCA Enterprise Administration.
From the sidebar, select RA Web of (Node B), where the RootCA is installed. (The RA Web is listed pretty much at the bottom of the list.)
In the RA Web search CA Certificates and CRLs in the top menu.
Click CA Certificates and CRLs to open.
In the table CA Certificates and CRLs go to the row for RootCA. Here you find the the option for downloading PEM in the column for Certificate chain.
Click PEM.
After the download is complete, Save the file.
Go back to EJBCA Enterprise Administration main page.
From the sidebar, in the CA Functions section, select Certification Authorities (Node A) where the pem file will be imported.
Click Import CA certificate...
Enter RootCA in the field The name this CA will be given
Browse for the file RootCA-chain.pem.
Click Import CA certificate.