> For the complete documentation index, see [llms.txt](https://docs.adaptiva.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.adaptiva.com/platform-guide/platform-management/certificates.md).

# Client Trusted Certificates

The Adaptiva client can leverage trusted certificates for secure client communication with network security applications or appliances. In the Admin Portal, you can issue trusted certificates to a PKI store on managed Adaptiva client groups or Business Units.

This enables scenarios such as SSL inspection, where the Adaptiva Client establishes trust with a security application (such as Zscaler) using the certificate provisioned to the pki store on the device. This feature supports Windows, MacOS, and Linux devices.

## Add Client Trusted Certificates

1. Navigate to **Settings > Client Trusted Certificates > Certificates**. The uploaded certificate must be a PEM-encoded X.509 certificate.

   ![Certificate Settings Menu](/files/qm1cpDWvLaQW9yAFwYr3)
2. Click **+ New**.
3. Enter a **Name**.
4. Open your .pem and copy the public key into the **Certificate** text box.
5. Click **Save**. The identity will be parsed from the certificate and displayed.

   ![Create New Certificate](/files/VU0IBNJWaTXz1Ujdib4i)

## Add Certificates with Policies

1. On the top level navigation of the certificates page, click **Policies**.
2. Click **+ New**.
3. Under General Settings, enter a **Name** and **Description** of the policy.
4. Under Certificate Settings, next to Certificates, click **Browse**.
5. On the Select Client Trusted Certificate page, click to select the certificate(s). You can multi-select if there are multiple certificates to deploy using a single policy.
6. Click **OK**.
7. Next to Target Groups, click **Browse**.
8. On the Select Group page, click to select the Group(s) or Business Unit(s) you wish to apply the policy to. You can define policies to target different groups of devices with different certificates.
9. Click **OK**.
10. Click **Save**.

    ![Certificate Policy Provisioning](/files/dcok0psCayoyPTvqIa69)

### Client Certificate Store

The Adaptiva Client by default looks in multiple certificate stores: the data/pki directory, the system trusted certificate store, and the JVM cacerts file. When changes are made to the certificate store, the Client will restart within 60 seconds to ensure that only up-to-date certificates are being used.

You can view the certificate store on a client machine by navigating to **%AdaptivaClient%\data\pki**. All certificates assigned to the client by a certificate policy will be stored as .crt files in this directory.