Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

IE7 aggressively warns about certificate failure; we have some internal sites that run over HTTPS and thus need a valid cert. We appear to have an certificate authority on the intranet that can sign SSL certs, but we have a problem: how do we mass configure desktops to trust the internal CA?

Is it possible to deploy the internal CA cert locally, via GPO?

share|improve this question

2 Answers 2

up vote 9 down vote accepted

The certificate can be distributed by group policy.

From: http://unixwiz.net/techtips/deploy-webcert-gp.html

In the Group Policy Object Editor, navigate down to: Computer Configuration

  • Windows Settings
  • Security Settings
  • Public Key Policies
  • Trusted Root Certification Authorities
  • Then right-click and select Import.
share|improve this answer
    
At first I thought this page was outdated and wrong, but it turns out we chose the wrong keyformat. –  jldugger May 31 '09 at 1:52

On Debian there's the pyca package for running a CA, however for all it does you basically need to know how OpenSSL's underlying CA support works.

There's always the AD CA tool, however I've found that it's only good for limited uses, perhaps have a main CA using the more capable OpenSSL based tools, then create an interim CA for the Windows stuff?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.