What to do about this error when adding pfx certificate?

Question

Active Directory

Certificate from Sectigo built in pfx

openssl pkcs12 -inkey private.key -in _domain_com.crt -export -out _domain_com.pfx

I am deploying a certification authority on a Windows server 2019
When adding a certificate, this is the error In the Microsoft-Windows-CertificateServices-Deployment/Operational


logs

Microsoft.CertificateServices.Deployment.Common.CA.CertificationAuthoritySetupException:
Microsoft.CertificateServices.Deployment.Common.CA.CertificationAuthoritySetupException
   в Microsoft.CertificateServices.ServerManager.DeploymentPlugIn.Provider.PowerShellCommandExecutor.Execute(Command command, IPowerShellEngine powerShellEngine, IRehydrator rehydrator)
   в Microsoft.CertificateServices.ServerManager.DeploymentPlugIn.Provider.CA.CAPSHProviderContext.Validate()
   в Microsoft.CertificateServices.ServerManager.DeploymentPlugIn.Provider.CA.Operations.SetExistingCertificate.Execute(ExistingCertificateParameters parameters)
   в Microsoft.CertificateServices.ServerManager.DeploymentPlugIn.DeploymentWizard.CA.ViewModels.ExistingCertificate.ExistingCertificateViewModel.Validate()

Answer 1

This certificate cannot be used for CA.
Why? - The CA is issuing certificates, and this certificate cannot be used to issue other certificates.

Answer 2

Heh, I got it, you decided to cheat and slip a regular certificate from the chest of drawers into the CA, in the expectation that it will accept and it will be possible to issue certificates, eventually signed by the chest of drawers?
No, that won't work. CA certificates - have a special mark "I am CA", which the chest of drawers will never supply to you.
You need to generate your own certificate, but of course it will be valid only inside your office, and then only if it is distributed by politicians.