Clarify adminconsole certs

deploy-manage/security/secure-your-elastic-cloud-enterprise-installation/manage-security-certificates.md

@@ -60,6 +60,19 @@ The PEM file should be structured like this:
 
 Each key and certificate would be generated by you or your IT team.
 
+::::{note} 
+{{ece}} expects to have private key start with a header of `-----BEGIN RSA PRIVATE KEY-----`. If your private key starts with a different header, for example, `-----BEGIN PRIVATE KEY-----` (no `RSA`), you will get error:
+
+```json
+{
+    "code" : "cert.invalid_cert_chain",
+    "message" : "Certificate chain was invalid [Invalid Entry: expected unencrypted rsa private key (is start of file corrupted?)]"
+}
+```
+
+We recommend you to review your certificate generating tool related documentation for how to obtain the ECE expected hearder for your private key. For example, if you use OpenSSL to generate your private key, you can use `-traditional` option. 
+::::
+
 
 ## Get existing ECE security certificates [ece-existing-security-certificates] 
 
@@ -295,6 +308,36 @@ To add a proxy certificate from the command line:
     openssl s_client -CAfile CA_CERTIFICATE_FILENAME -showcerts -connect HOSTNAME_OR_IP:9343 < /dev/zero
     ```
 
+## Add an Adminconsole certificate [ece-tls-adminconsole] 
+
+::::{note} 
+In {{ece}}, this certificate is treated identically to the [Cloud UI certificate](#ece-tls-ui). You can use the same certificate bundle generated for Cloud UI.
+::::
+
+To add an Adminconsole certificate from the Cloud UI:
+
+1. [Log into the Cloud UI](../../deploy/cloud-enterprise/log-into-cloud-ui.md).
+2. From the **Platform** menu, select **Settings**.
+3. Under **TLS settings** for the Adminconsole, choose **Upload new certificate** and select a concatenated file containing your RSA private key, server certificate, and CA certificate. Upload the selected file.
+
+To get the details of the certificate you added, select **Show certificate chain**.
+
+To add an Adminconsole certificate from the command line:
+
+1. Add the certificate for the Adminconsole to your {{ece}} installation, where `CA_CERTIFICATE_FILENAME` is the name of the CA certificate you downloaded earlier and `ADMINCONSOLE_PEM_FILENAME` is the name of the concatenated file containing your RSA private key, server certificate, and CA certificate:
+
+    ```
+    curl --cacert CA_CERTIFICATE_FILENAME -H 'Content-Type: application/json' --data-binary @ADMINCONSOLE_PEM_FILENAME --user "admin:PASSWORD" "https://admin:12443/api/v1/platform/configuration/security/tls/adminconsole"
+    ```
+
+2. Log out of the Cloud UI and log in again.
+3. Verify that you are now using the new certificate chain. There should be no security warnings when you connect to the  Cloud UI over HTTPS in your web browser.
+
+    Alternatively, you can also check the certificate using the openssl command:
+
+    ```
+    openssl s_client -CAfile CA_CERTIFICATE_FILENAME -showcerts -connect containerhost:12343 < /dev/zero
+    ```
 
 
 ## Limitations [ece-tls-limitations]