Without trying the steps to be certain, yes those all look correct to me. There's some more steps/nuance around the external CA where you'll need to craft the identity file, put a cert/key in an expected location, etc. but overall the process seems about right to me.