Skip to content
Configure › Code Signing › Platform Security
Release: Australia · Updated: 2026-03-12 · Official documentation · View source

Import and install certificates for Circle of Trust

Retrieve the update set in production to establish the trust relationship between the two instances. The certificates that have been created to represent trust in the trusted instance must be accepted into the protected instance.

Before you begin

Roles required: admin, security_admin

Procedure

  1. In the protected instance, navigate to System Update Sets > Retrieved Update Sets.

  2. Select the Import Update Set from XML button on the bottom-left corner of the screen.

Image omitted: import-update-set-1.png
Import XML screen to retrieve update set.
  1. Select Choose File and browse to select the XML file that you exported in Prepare Circle of Trust certificates.
Image omitted: retrieve-update-set.png
Import XML screen to retrieve update set.

  1. Select Upload.

    The Code Signing update set is added to the Retrieved Update Sets table.

Image omitted: loaded-updateset-prod.png
Loaded update set to production.
**Note:** If you don’t see your update set, filter your list for records in the Loaded state, and sort the list by the **Loaded** field.

  1. Open the update set record to verify that the Customer Updates table contains the following three records:

    • Two KMF Signature Records
    • X.509 Certificate
Image omitted: prod-customer-updates-retrieved.png
Shows the imported certificate and signature records into production.

  1. Select Preview Update Set.

  2. Select Commit Update Set.

Image omitted: committed-updateset.png
Shows the State updated to Committed.
The Retrieved Update Set **State** updates to Committed.

  1. In the navigator, enter sn_kmf_record_signature.list to open the KMF Signature Records list.

  2. Locate the two KMF signature records.

    These records are the most recently created records where the KMF Signature Purpose field has a value of Circle of Trust. You may need to add the Created field to your list, or filter for records created on the current date.

  3. In the navigator, enter sys_certificate.list and open the record with a Short description value of code_signing_key and a Type value of Trust Store Cert.

  4. Select Install Trusted Code Signing cert.

Image omitted: install-trusted-code-signing-cert.png
X.509 form to install trusted Code Signing cert.
The certificate type updates to `Trusted CodeSigning Cert`.

**Important:** Repeat these steps for your second certificate. Remember that there’s a certificate for both the cm\_code\_attest and cm\_code\_signing cryptographic modules.

Result

The trust relationship is established between trusted and protected instances. You’re ready to enable Code Signing. See Turn on Code Signing to complete the steps.