An enterprise using private PKI sees DTLS failures after replacing controllers because WAN Edges do not trust the new controller certificates. The chain was never pushed beyond the CA server. Which root-certificate installation restores trust on controllers and WAN Edges?

Private PKI replaces the default Cisco trust hierarchy, so every device that validates DTLS peer certificates must hold the enterprise root chain in its local trust store, and because the chain was never pushed beyond the CA server after the controller replacement, manually installing it on SD-WAN Manager, controllers, validators, and all WAN Edges is the only way to rebuild bidirectional authentication and clear DTLS failures. Installing only the intermediate chain on the same set of devices fails by chain-building concept because peers cannot anchor validation to a trusted root without the self-signed root present, so verification still fails despite correct intermediates. Limiting the root installation to newly added WAN Edges fails by scope concept because existing edges that must still form DTLS to the new controllers retain no anchor for the new controller certificates and remain down. Keeping controllers on default Cisco trust while distributing the enterprise root elsewhere fails by mutual-authentication concept because controllers must also validate Manager, validator, and edge certificates chaining to the enterprise root, so one-sided trust still breaks DTLS. For the exam, remember that root trust is never learned via OMP or control-plane updates and must be pre-installed before certificate renewal or controller replacement. In practice, verify with show certificate and chain validation on each role and confirm DTLS sessions transition to up after installing the root and reinstalling identity certificates where needed.