As the certificates on my Zenworks server are about to expire soon, I am in a process of replacing the certificates as described here:

The new server certificate is issued by new CA, so I also need to install new CA certificate on workstation. I have tried this manually on one machine, and it gave every indication that it worked:

zac ci c:\temp\new-ca.der

user name: myusername
password: ********

Successfully added the root certificate to machine store.
Now I'll probably create a bundle to do this on all managed devices. But I have two questions:

1. How can I verify that the new CA certificate has actually been imported? 'zac ci' by itself shows only server certificates and not CA certificates. On the machine where new CA certificate has been imported, registry keys HKLM\Software\Novell\ZCM\CASubject and HKLM\Software\Wow6432Node\Novell\ZCM\CASubject still contain the old CA subject name.

2. What are the minimum rights for Zenworks administrator account to be able to import the CA certificate? I would like to not include my own username and password in the bundle but create a special account just for this task.