Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Given we have the following network/CA structure:

Win2K8R2 - Root CA - no idea where its' certificate is?

Win2K8R2 - Sub CA - obtained CA certificate from Root CA

Win2K8R2 - OWA 2010 (Basically, a Web Server) - obtained an SSL certificate from SubCA

A client connects to the OWA web site and get's a warning, that the authority that has issued a certificate is not in trusted store.


What is the secure way to obtain a root CA certificate to import it to a trusted CA store on a client machine, given that I have an admin access to a Root CA.

Thank you.

share|improve this question
up vote 1 down vote accepted

The simplest way is to naviagte to https:///CertSrv authenticate and then click on "Download a CA certificate, certificate chain, or CRL".

Another way is to connect to the CA server, start an MMC, add a "certificates" snap-in, point it to "computer account", navigate to "personal"\"certificates" and then export the root.

Edit: once you have the certificate, you can either import it directly on the target machine or distribute it across your whole domain using GPO.

share|improve this answer
Good. Thank you. – Maxim V. Pavlov Sep 7 '11 at 12:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.