---
title: "ezgh private-ca ca import"
description: "Import an external subordinate's signed certificate."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.ezghcloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ezgh private-ca ca import

{/* Generated by ezgh-cli's internal/tools/clidocs from the ezgh command tree. Don't edit: change the command's help in ezgh-cli and regenerate. */}

```sh
ezgh private-ca ca import <ca> --chain <file> [flags]
```

Import the certificate your root signed from an external subordinate's CSR. `--chain` is a PEM file (- for stdin): this CA's certificate first, then each CA certificate above it, ending with your root. EZGH checks the key, subject, constraints and chain, then activates the CA. `--wait` waits for it (at most `--wait-timeout`).

Part of [`ezgh private-ca ca`](/cli/reference/private-ca-ca).

## Examples

```sh
ezgh private-ca ca import corp-issuing --chain signed.pem --wait
```

## Flags

| Flag | Type | Default | Description |
| --- | --- | --- | --- |
| `--chain` | string |  | the signed certificate and its chain, PEM (- for stdin) |
| `--wait` | boolean |  | wait until it's active, and print it then |
| `--wait-timeout` | duration | `10m0s` | how long `--wait` waits |

This command also takes the [global flags](/cli/reference#global-flags).

Source: https://docs.ezghcloud.com/cli/reference/private-ca-ca-import/index.mdx