I am planning to setup PKI for our organization as we're fed up with all of these security warnings when using self-signed certs. I want an offline root CA and two issuing CAs and I want to set that up on Linux systems.
How can I easily distribute root and identity (server) certificates to end users without explaining each of them how to install them in the browser?
Does Active Directory do that, via GPO for example? If so, is does it only support Internet Explorer? Can I do that without having to install AD CS?
Also I wonder if there is an interface for CA (GUI/web) of some kind where server admins can login and request certificates for their needs?
Hopefully, that makes any sense as I'm pretty new to PKI :) I'm very sorry, if it is all over the place on the Internet and I suck at Google'ing, but I really can't find what I need...