DCS Internal Certificate Management

Secure your infrastructure with automated certificate management

For Developers & System Administrators

New! Configure automatic SSL/TLS certificate renewal for your servers using our internal Step-CA ACME server.

Open Step-CA Configuration Guide

Client Certificate Installation

Install the IRIX Root CA certificate on your system to trust internal certificates.

Follow the steps below to add the IRIXCA.crt certificate into the Trusted Root Certification Authorities store in Windows:

Step 1: Download the IRIXCA.crt File

Ensure you have the IRIXCA.crt certificate file on your Windows machine.

Download IRIXCA.crt

Step 2: Open the Certificate File

Double-click on the IRIXCA.crt file to open it. This will open the Certificate window.

Step 3: Install the Certificate

  1. Click the Install Certificate button.
  2. In the "Certificate Import Wizard", select Local Machine and click Next.
  3. Choose Place all certificates in the following store and click Browse.
  4. Select Trusted Root Certification Authorities and click OK.
  5. Click Next and then Finish.

Step 4: Confirm the Installation

A message will appear saying "The import was successful." Click OK.

Step 5: Restart Your Browser

Close and reopen your browser (Chrome, Edge, Firefox) for the changes to take effect.

Important: After completing these steps, your browser will trust the IRIXCA certificate, and you will be able to visit secure sites signed with it without warnings.

Quick Install fingerprint verified

Open Windows PowerShell as Administrator and paste the block below. It downloads the CA, checks the SHA-256 fingerprint, and only imports it on a match:

$exp = "9A9CA6E17DEF077B90ACBC223E086D858B69E0D04AB4DE405F59408306DD2F9B"
$f = "$env:TEMP\IRIXCA.crt"
[Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }
Invoke-WebRequest https://devs.irix.dcs/IRIXCA.crt -OutFile $f -UseBasicParsing
$c = [Security.Cryptography.X509Certificates.X509Certificate2]::new($f)
$fp = [BitConverter]::ToString([Security.Cryptography.SHA256]::Create().ComputeHash($c.RawData)).Replace('-','')
if ($fp -eq $exp) {
    Import-Certificate -FilePath $f -CertStoreLocation Cert:\LocalMachine\Root | Out-Null
    Write-Host "OK: IRIX Root CA installed and trusted"
} else {
    Write-Host "ABORTED: fingerprint mismatch -> $fp"
}
Remove-Item $f -Force -ErrorAction SilentlyContinue

The certificate-validation bypass applies only to this PowerShell session and is needed because the download server itself uses an IRIX-signed certificate (one-time bootstrap). Restart your browser afterwards.

Follow the steps below to add the IRIXCA.crt certificate to the System keychain and mark it as trusted on macOS:

Step 1: Download the IRIXCA.crt File

Download the certificate to your Mac. It will be saved to your Downloads folder.

Download IRIXCA.crt

Step 2: Verify the Certificate Fingerprint

Open Terminal and confirm the SHA-256 fingerprint before trusting the certificate:

openssl x509 -in ~/Downloads/IRIXCA.crt -noout -fingerprint -sha256
Expected fingerprint:
SHA256 Fingerprint=9A:9C:A6:E1:7D:EF:07:7B:90:AC:BC:22:3E:08:6D:85:8B:69:E0:D0:4A:B4:DE:40:5F:59:40:83:06:DD:2F:9B
If the fingerprint does NOT match, delete the file immediately and contact IT security.

Step 3: Install & Trust the Certificate

Option A — Keychain Access (graphical):

  1. Double-click IRIXCA.crt to open it in Keychain Access.
  2. When prompted, add it to the System keychain and authenticate with your password.
  3. Find IRIX Root CA in the System keychain and double-click it.
  4. Expand the Trust section and set "When using this certificate" to Always Trust.
  5. Close the window and authenticate again to save the trust setting.

Option B — Terminal (one command):

sudo security add-trusted-cert -d -r trustRoot \
  -k /Library/Keychains/System.keychain ~/Downloads/IRIXCA.crt

Step 4: Restart Your Browser

Close and reopen Safari, Chrome, or Edge for the change to take effect.

Firefox users: Firefox keeps its own certificate store. Import IRIXCA.crt via Settings → Privacy & Security → Certificates → View Certificates → Authorities → Import, then enable "Trust this CA to identify websites."

Quick Install fingerprint verified

Open Terminal and paste the block below. It downloads the CA, checks the SHA-256 fingerprint, and only adds it to the System keychain on a match:

EXP=9A9CA6E17DEF077B90ACBC223E086D858B69E0D04AB4DE405F59408306DD2F9B
curl --insecure -fsSL -o /tmp/IRIXCA.crt https://devs.irix.dcs/IRIXCA.crt
FP=$(openssl x509 -in /tmp/IRIXCA.crt -noout -fingerprint -sha256 | cut -d= -f2 | tr -d ':' | tr 'a-z' 'A-Z')
if [ "$FP" = "$EXP" ]; then
  sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /tmp/IRIXCA.crt
  echo "OK: IRIX Root CA installed and trusted"
else
  echo "ABORTED: fingerprint mismatch -> $FP"
fi
rm -f /tmp/IRIXCA.crt

--insecure is needed only for this one-time bootstrap because the download server itself uses an IRIX-signed certificate; the fingerprint check above is what actually secures the operation. Restart your browser afterwards.

To trust internal IRIX certificates on a Linux machine you only need to add the IRIX Root CA to the system trust store. The commands differ by distribution family. (If you also need to issue and auto-renew certificates for your own server, follow the full guide linked at the bottom.)

RHEL-based (AlmaLinux, Rocky, RHEL)

# Download, verify the fingerprint, then trust
sudo curl --insecure -o /etc/pki/ca-trust/source/anchors/IRIXCA.crt \
  https://devs.irix.dcs/IRIXCA.crt
openssl x509 -in /etc/pki/ca-trust/source/anchors/IRIXCA.crt -noout -fingerprint -sha256
sudo update-ca-trust

Debian-based (Ubuntu, Debian)

# Download, verify the fingerprint, then trust
sudo curl --insecure -o /usr/local/share/ca-certificates/IRIXCA.crt \
  https://devs.irix.dcs/IRIXCA.crt
openssl x509 -in /usr/local/share/ca-certificates/IRIXCA.crt -noout -fingerprint -sha256
sudo update-ca-certificates
Expected fingerprint:
SHA256 Fingerprint=9A:9C:A6:E1:7D:EF:07:7B:90:AC:BC:22:3E:08:6D:85:8B:69:E0:D0:4A:B4:DE:40:5F:59:40:83:06:DD:2F:9B
If the fingerprint does NOT match, delete the file immediately and contact IT security.
Browsers: The system store covers curl, git, and most CLI tools. Firefox (always) and Chrome/Chromium (its own NSS store) may need a separate import via their certificate settings.

Quick Install fingerprint verified

RHEL-based — paste into a terminal; it installs only if the fingerprint matches:

EXP=9A9CA6E17DEF077B90ACBC223E086D858B69E0D04AB4DE405F59408306DD2F9B
sudo curl --insecure -fsSL -o /tmp/IRIXCA.crt https://devs.irix.dcs/IRIXCA.crt
FP=$(openssl x509 -in /tmp/IRIXCA.crt -noout -fingerprint -sha256 | cut -d= -f2 | tr -d ':' | tr 'a-z' 'A-Z')
if [ "$FP" = "$EXP" ]; then
  sudo cp /tmp/IRIXCA.crt /etc/pki/ca-trust/source/anchors/IRIXCA.crt && sudo update-ca-trust
  echo "OK: IRIX Root CA installed and trusted"
else
  echo "ABORTED: fingerprint mismatch -> $FP"
fi
rm -f /tmp/IRIXCA.crt

Debian-based:

EXP=9A9CA6E17DEF077B90ACBC223E086D858B69E0D04AB4DE405F59408306DD2F9B
sudo curl --insecure -fsSL -o /tmp/IRIXCA.crt https://devs.irix.dcs/IRIXCA.crt
FP=$(openssl x509 -in /tmp/IRIXCA.crt -noout -fingerprint -sha256 | cut -d= -f2 | tr -d ':' | tr 'a-z' 'A-Z')
if [ "$FP" = "$EXP" ]; then
  sudo cp /tmp/IRIXCA.crt /usr/local/share/ca-certificates/IRIXCA.crt && sudo update-ca-certificates
  echo "OK: IRIX Root CA installed and trusted"
else
  echo "ABORTED: fingerprint mismatch -> $FP"
fi
rm -f /tmp/IRIXCA.crt
Setting up a server? To issue and automatically renew certificates for your own Apache/Nginx service, follow the full guide.
Open Step-CA Configuration Guide

Test the HTTPS Connection

After installing the certificate, you can test the secure connection using the links below:

Test devs.irix.dcs Test main.irix.stage.dcs Test release.irix.stage.dcs