Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a Microsoft enterprise certificate authority, and I would like to start issuing a few code signing certificates.

But what I'm unsure of is this: since all our domain/forest machines trust the internal CA, when I issue code signing certificates: will all the client systems automagically trust the code signing certs for executing any code, or do I need to add the individual users' code signing certs to the clients' "Trusted People" store (like you might do with their self-signed or third-party certs)?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

If you issue the certificates using a trusted CA, then all these certificates will be trusted by your machines. You can have a look at this page.

share|improve this answer
    
That's what I suspected... thanks for the confirmation. We'll just have to be careful who we issue the code signing certs to, as they'll be inheriting a lot of power. –  ewall Dec 2 '11 at 17:15

It depends... I used to think that way, but then we started using System Center Update Manager. For the cert to be trusted in this case, it needs to be added to the "Trusted Publishers" store even when it's from your CA.

http://mikeshellenberger.wordpress.com/2010/09/02/system-center-updates-publisher-microsoft-pki/

share|improve this answer
    
Hmm... interesting. Guess I'll have to try it and see! –  ewall Dec 6 '11 at 15:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.