Install the Required CA Certificates on Linux

Table of Contents

Prepare Your NixOS System for Prisma Agent Installation

Install the Required CA Certificates on Linux

Install the GoDaddy root and intermediate CA certificates that Prisma Agent requires to authenticate with the Endpoint Manager on Linux.

Where Can I Use This?	What Do I Need?
Prisma Agent	Linux endpoints (Ubuntu, Debian, Fedora, RHEL, Oracle Linux, or Arch Linux)

The Prisma Agent connects to the Endpoint Manager over TLS. For the agent to successfully authenticate and enroll with the Endpoint Manager, your Linux endpoint must trust the Go Daddy Root Certificate Authority - G2 certificate. Linux distributions do not always include this certificate in their default trusted CA bundle, so you must add it before installing the agent.

For NixOS, add the certificate paths to the security.pki.certificateFiles parameter in your configuration.nix file as described in the NixOS preparation steps instead of using the steps below.

For all other supported Linux platforms, use the following steps to install the certificates.

Download the required certificates from the GoDaddy Certificate Repository:
- Go Daddy Root Certificate Authority - G2 (root CA)
  SHA-256 thumbprint: 45140B3247EB9CC8C5B4F0D7B53091F73292089E6E5A63E2749DD3ACA9198EDA
- Go Daddy Secure Certificate Authority - G2 (intermediate CA)
  SHA-256 thumbprint: 973A41276FFD01E027A2AAD49E34C37846D3E976FF6A620B6712E33832041AA6

Copy the certificate files to your distribution's CA trust directory:

For Ubuntu and Debian:

sudo cp godaddy-root-g2.crt godaddy-intermediate-g2.crt /usr/local/share/ca-certificates/

For Fedora, Red Hat Enterprise Linux, and Oracle Linux:

sudo cp godaddy-root-g2.crt godaddy-intermediate-g2.crt /etc/pki/ca-trust/source/anchors/

For Arch Linux:

sudo cp godaddy-root-g2.crt godaddy-intermediate-g2.crt /etc/ca-certificates/trust-source/anchors/

Update the trusted CA certificate store:
- For Ubuntu and Debian:
```
sudo update-ca-certificates
```
- For Fedora, Red Hat Enterprise Linux, and Oracle Linux:
```
sudo update-ca-trust
```
- For Arch Linux:
```
sudo trust extract-compat
```
Verify that the certificates were added successfully:
```
openssl verify -CAfile /etc/ssl/certs/ca-certificates.crt godaddy-root-g2.crt
```
A successful response returns godaddy-root-g2.crt: OK.
Proceed with the Prisma Agent.

Prepare Your NixOS System for Prisma Agent Installation

Install the Prisma Agent

Prisma Agent Docs

Install the Required CA Certificates on Linux

Prisma Agent Docs

Install the Required CA Certificates on Linux

Activation and Onboarding

SASE

Cloud-Delivered Security Services

Network Security

Endpoints

Visibility & Monitoring

Best Practices

Experts Corner