Certificate Deployment Group Policy Overview

If you have ever come across one of Internet Explorer's infamous "certificate error" screens (see the image below taken from IE7), then you know how intimidating they can be (especially for your users.)

Certificate errors on your intranet are usually caused by one of two things:

• An expired certificate
• A self signed certificate that was created by an untrusted signing authority
  Note: For the purpose of this discussion, we are only talking about intranet (internal network) certificate errors.  Certificate errors on the web are an entirely different matter.

In the case of a untrusted signing authority, this may not necessarily be a problem since, as the system administrator of the site, you probably created the certificate and know it is safe.  Therefore, you may wish to suppress the default behavior of the browser to prevent your users from seeing the warnings.

Group policy offers a quick and easy way to deploy certificates in the enterprise.  Using a group policy object or GPO, we can deploy certificates to the enterprise without having to visit every machine on the network.  This guide will show you how to override your browser's certificate verification implicitly trusting the signing authority using a GPO.  Lets get to it!

Certificate Export

In the steps below, we will use Internet Explorer 6 to export the certificate to our local machine.  Your actual screens may differ slightly depending on your operating system and web browser, but the concepts remain the same.

1. Using your browser, navigate to the internal address of the "problem child"
   
   
2. When presented with the security alert, click the "View Certificate" button
   
   
   
   
3. Click the "Details" tab from the certificate information window
   
   
   
   
4. Click the "Copy to File" button from the details screen
   
   
   
   
5. Click the "Next" button on the certificate export wizard
   
   
   
   
6. Select the "DER encoded binary X.509" option and click "Next"
   
   
   
   
7. Provide a file name to save the certificate as on your local machine
   
   
   
   
8. Click "Finish" to complete the export
   
   
   
   

Configuring the GPO

We will now define a new Group Policy Object (GPO) on an organizational unit (OU.)

1. Logon to your domain controller as a domain administrator
   
   
2. Run "dsa.msc" to open Active Directory Users and Computers
   
   
   
   
3. Find a toplevel OU that contains the computer objects you wish to apply the GPO on.  Right click on the OU and select the "Properties" option
   
   
   
   
4. Click the "Group Policy" tab from the OU properties window
   
   
   
   
5. Click the "New" button to create a new GPO
   
   
   
   
6. Provide a meaningful name to your new GPO, and then click the "Edit" button
   
   
   
   
7. Locate the "Trusted Root Certification Authorities" folder from the Group Policy Object Editor window
   
   
   
   

   Computer Configuration -> Windows Settings -> Security Settings -> Public Key Policies -> Trusted Root Certification Authorities

   
   
8. Right click on "Trusted Root Certification Authorities" and select the "Import" option
   
   
   
   
9. Click the "Next" button on the certificate import wizard screen
   
   
   
   
10. Provide the location to the exported certicate from the previous section
    
    
    
    
11. Select the "Place all certificates in the following store" option and click "Next"
    
    
    
    
12. Click "Finish" on the confirmation screen
    
    
    
    
    
    
13. Exit the GPO editor and reboot (or perform a gpupdate) from one of the computers within the affected OU.  You should find the certificate has been installed in the browsers Trusted Root Certification Authorities.
    
    
    

Nice work on installing the certificate!  From the computer you rebooted in step #13, you should be able to browse the website that had previously thrown a certificate error without reciving any warnings.  Good luck!

Add this page to your favorite website

Comments

Add New Search

myname  - mo |15/07/2011 07:59:25 hola Reply | Quote

Write comment
Name:
Email:	do not notifynotify
Website:
Title:
UBBCode:	-color-aquablackbluefuchsiagraygreenlimemaroonnavyolivepurpleredsilvertealwhiteyellow -size-tinysmallmediumlargehuge
	Please input the anti-spam code that you can read in the image.

!joomlacomment 4.0 Copyright (C) 2009 Compojoom.com . All rights reserved."