Solaris won't update because ddt-incorporation is using a self-signed certifcate

I'm trying to update my Solaris 11.3 x86 system. The system hasSun/Oracle software on it, including Sun Developer Studio and Sun SSH server. It does not have other software on it, and I don't have anything in /usr/local. I'm catching this error: $ sudo pkg update Creating Plan (Package planning: 1/10): - pkg update: Chain was rooted in an untrusted self-signed certificate. The package involved is pkg://solaris/consolidation/ddt/ddt-incorporation@18.3.18.7.13,0.5.11-11.4.0.0.1.11.0:20180718T212443Z According to [Packaging and Delivering Software With the Image Packaging System | Untrusted Self-Signed Certificate](https://docs.oracle.com/cd/E36784_01/html/E36856/glycf.html) , the docs say it is because of using a self-signed OpenSSL certificate. Another similar page is [Troubleshooting Signed Packages](https://docs.oracle.com/cd/E26502_01/html/E21383/signerrs.html) , but it rehashes the earlier page and adds nothing new. The Oracle docs on updating a package is at [Updating a Package](https://docs.oracle.com/cd/E23824_01/html/E21802/gihhp.html#gijkt) but it does not appear to provide the information I need. The Sun article lacks step-by-step instructions to clear the issue. I'm trying to get Solaris to trust the Sun certificate but I can't get beyond usage errors: $ sudo pkg set-publisher --approve-ca-cert solaris/consolidation/ddt/ddt-incorporation pkg set-publisher: requires a publisher name Usage: pkg set-publisher [-Ped] [-k ssl_key] [-c ssl_cert] [-g origin_to_add|--add-origin=origin_to_add ...] [-G origin_to_remove|--remove-origin=origin_to_remove ...] .... And: $ sudo pkg set-publisher --approve-ca-cert solaris/consolidation/ddt/ddt-incorporation sun pkg set-publisher: Could not find /export/home/jwalton/solaris/consolidation/ddt/ddt-incorporation I've tried other combinations, like prepending pkg:// and using the full name but the problems persist. How do I get beyond this error?