Entrust PKI Hub 1.0 requires the full TLS certificate chain for the Certificate Enrollment Gateway certificate, from the TLS certificate up to the root CA. Obtain all CA certificates in the CA certificate chain, from the issuing CA to the root CA. (In your environment, the issuing CA may be the root CA.) The CA certificates must be in PEM format.

After obtaining all CA certificates in the certificate chain, proceed to Building a TLS certificate chain for the Certificate Enrollment Gateway certificate.