Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a Microsoft enterprise certificate authority, and I would like to start issuing a few code signing certificates.

But what I'm unsure of is this: since all our domain/forest machines trust the internal CA, when I issue code signing certificates: will all the client systems automagically trust the code signing certs for executing any code, or do I need to add the individual users' code signing certs to the clients' "Trusted People" store (like you might do with their self-signed or third-party certs)?

share|improve this question
up vote 2 down vote accepted

If you issue the certificates using a trusted CA, then all these certificates will be trusted by your machines. You can have a look at this page.

share|improve this answer
That's what I suspected... thanks for the confirmation. We'll just have to be careful who we issue the code signing certs to, as they'll be inheriting a lot of power. – ewall Dec 2 '11 at 17:15

It depends... I used to think that way, but then we started using System Center Update Manager. For the cert to be trusted in this case, it needs to be added to the "Trusted Publishers" store even when it's from your CA.

share|improve this answer
Hmm... interesting. Guess I'll have to try it and see! – ewall Dec 6 '11 at 15:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.