Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a problem with a specific website which our staff need to access via Internet Explorer on our Citrix server (running Win2K3).

When connecting via SSL (a requirement), the site is inaccessible because the certificate issuer's certificate is not in the Trusted Root Certification Authorities.

If I manually import the certificate chain (exported my PC), it works, but I'd rather not do that for each user: Is there a way I can import the certificate for all users?

I found this MS KB article which details importing certificates in to the Local Computer store to resolve a different issue; would that apply here?

share|improve this question

Importing the certificate into the machine's Trusted Root Certificate store will resolve your issue. It's not necessary for the CA to be trusted by each user. If the machine trusts the CA then the users will "inherit" that trust automatically.

The procedure in that KB article is basically correct. Be sure to choose the computer when adding the Certificates snap-in and the "Trusted Root Certificate Authorities" when choosing the store to place the certificate into.

share|improve this answer
Surprisingly, this method did not work. I haven't rebooted the server yet, though; I won't be able to do that for a couple of weeks. If that doesn't resolve it I'll probably try the GPO method as plan B. – Chris Feb 24 '12 at 14:50

Why not deploy the certificate via Group Policy? This link can guide you on how to do this.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.