# ZAC (manage certificate authorities)

**URL:** <https://openziti.discourse.group/t/zac-manage-certificate-authorities/3019>\
**Category:** Uncategorized\
**Created:** [August 22, 2024, 1:58am UTC](https://openziti.discourse.group/t/zac-manage-certificate-authorities/3019 "2024-08-22T01:58:39Z")\
**Posts on this page:** 1\
**Showing post:** 8

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [August 26, 2024, 6:26pm UTC](https://openziti.discourse.group/t/zac-manage-certificate-authorities/3019/8 "2024-08-26T18:26:11Z")

</div>

> [@zhaojun1217](#):
>
> Is it necessary to enable all of them?

No. You only need to enable the mechanism you want to support. You definitely need auth enabled if you want to use it for authentication. You also need to map the external id to an identity unless you're auto-enrolling.

> What is the proper workflow to verify this functionality?

The proper flow is:

- add the CA to ziti
- obtain the 'verify' token from the controller CA endpoint
- produce a certificate with the verify token as the common name (CN)
- submit the certificate to the controller using ZAC or mgmt endpoint
- create a key/cert to use to auth and submit it for authentication

Have you seen [Creating Endpoint with your own Certificate Authority - #12 by TheLumberjack](https://openziti.discourse.group/t/creating-endpoint-with-your-own-certificate-authority/433/12) and the video [https://www.youtube.com/watch?v=USMim65c4ic](https://www.youtube.com/watch?v=USMim65c4ic) ?

That might help you out?

---

_[View the full topic](https://openziti.discourse.group/t/zac-manage-certificate-authorities/3019)._