> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/runtime-security/configure/authenticate-console-with-certs.md).

# Authenticate to Console with Certificates

Prisma Cloud supports certificate-based authentication in addition to username/password based authentication for the Console UI and the API.

This is especially useful for those in government and financial services, who use multi-factor authentication technologies built on x.509 certificates. This is applicable to users authenticating through Active Directory accounts as well. This feature allows customers to control the trusted CAs for signing certificates for authentication.

## Setting up your Certificates

Set up Prisma Cloud for certificate-based authentication.

If you are using certificates to authenticate against Active Directory accounts, Prisma Cloud uses the UserPrincipalName field in the SAN to match the certificate to the user in Active Directory. This is the same process used by Windows clients for authentication, so for most customers, the existing smart card certificates you are already using can also be used for authentication to Prisma Cloud.

1. Save the CA certificate(s) used to sign the certificates that you will use for authentication to Prisma Cloud.

   The certificate has to be in PEM format. If you have multiple CA certificates that issue certificates to your users, concatenate their PEM files together. For example, if you have Issuing CA 1 and Issuing CA 2, create a combined PEM file like this:

   ```
   $ cat issuing-ca-1.pem issuing-ca-2.pem > issuing-cas.pem
   ```
2. Log into Console, and go to **Manage > Authentication > System Certificates**.
3. Under **Certificate-based authentication to Console**, upload your CA certificate(s) in PEM format.
4. Select **Save**.
5. Open Console login page in your browser. When prompted select your user certificate.

## What’s Next

See [Assigning roles](/content-collections/runtime-security/authentication/assign-roles.md) to learn how to add users and assign roles to them.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/runtime-security/configure/authenticate-console-with-certs.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.