> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xorlab.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Pages under /latest/ document the current release. Paths that begin with a version number, for example /10.0/, are frozen snapshots of superseded releases kept for reference only — never present their instructions as current. If the reader's version is unknown, answer from /latest/ and say which version the answer describes.
> xorlab is deployed on-premises, hybrid, or as a cloud service, and integrates with either Microsoft 365 or on-premises mail infrastructure. Configuration steps often differ between these. State which deployment and integration mode an instruction applies to instead of presenting one as universal.
> Distinguish inline mode from monitoring mode when describing anything that acts on email. Monitoring mode observes a copy and cannot block or quarantine; inline mode routes mail through xorlab and can.
> Write the product name as lowercase 'xorlab'. Use the documented component names: xorlab Control Center (XCC), xorlab MTA, xorlab Sandbox (DANA), xorlab Natural Language Understanding (NLU). After the first mention, use the short forms XCC, MTA, Sandbox, and NLU. Do not use DANA as a standalone name for the Sandbox, but keep it where it is a literal string in configuration keys, container names, and hostnames.
> Do not invent configuration keys, rule parameters, list names, log properties, or API fields. If a value is not present in this documentation, say that it is not documented rather than guessing.

# Add Trusted CA Certificates

> Add a custom certificate authority to the xorlab trust store so LDAP and SAML2 connections validate.

<Note>
  **Trust store**

  You must have the certificate(s) ready in a PKCS12 trust store named `truststore.p12`. The trust store must contain all certificates required for all trusted communication initiated by xorlab Authentication Service (LDAP, SAML2, etc.). For every service, only the outermost signer certificate is required to be a part of the trust store as long as the service supplies a correct certificate chain. By inserting a concrete server certificate into the trust store, that certificate is pinned explicitly.

  To create a trust store, you can use [Keytool](https://docs.oracle.com/cd/E19509-01/820-3503/6nf1il6er/index.html) or [OpenSSL](https://www.ssl.com/how-to/create-a-pfx-p12-certificate-file-using-openssl/). In a nutshell, you have to add your certificate file (.pem, .crt, .cer, .p7b, or .p7c) to the trust store. You can do this with the following `keytool` command:

  `keytool -import -file certificate.pem -alias ca1 -keystore truststore.p12`

  This command will export your `certificate.pem` file to the `truststore.p12` trust store file, giving the certificate a `ca1` alias.
</Note>

1. Open the `auth/auth/auth.yml` file using the XCC [Expert Editor](/latest/expert-editor).

2. Add the following block and enter the password of your provided trust store:

   ```yaml auth.yml theme={null}
   trustStore:
     # The type of the trust store to use. Default is PKCS12 which is also the default
     # these days when using the 'keytool' shipped with the JRE.
     type: pkcs12
     # The default trust store file. Defaults to 'truststore.p12'. Relative paths are resolved
     # relative to the config directory.
     file: truststore.p12
     # The trust store password.
     password: <trust_store_password>
   ```

   <Info>
     The password of the trust store delivered with a new deployment is documented in
     [Deployment Defaults → Trust store password](/latest/deployment-defaults#trust-store-password).
     Access to that page is restricted.
   </Info>

3. Click **Publish**. The authentication configuration becomes active within about one minute.

4. Switch to the CLI of the XCC and execute the following instructions one by one:

   ```shell theme={null}
   sudo su -s /bin/bash xcc_backend
   cd /var/lib/xorlab/xcc/config/work/ag_local/auth/auth
   ```

5. Copy the `truststore.p12` file containing your certificate into the folder specified above.

6. Execute the following instructions one by one:

   ```shell theme={null}
   git add .
   git commit -m "Adding truststore file"
   exit
   ```

The Authentication service restarts automatically and applies the new configuration.