Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I look after ~50 machines running XP/Vista, all on a single Windows Server 2008 domain. We are rolling out a number of test webservers internally, which have their SSL certificates signed with a company internal CA.

To prevent users being confused by SSL warnings, I need to install the CA's certificate on each of the machines.

Any ideas how to automatically install a certificate on Windows machines for IE and Firefox?

share|improve this question
up vote 2 down vote accepted

Your best bet is to deply your root certificate to the machines using group policy. This article here explains the process in good detail.

share|improve this answer
That won't help for firefox. ( – Zoredache Oct 22 '09 at 16:22
Very true, which is a bit of a pain – Sam Oct 22 '09 at 16:24

FirefoxADM will help you deploy CA certs for firefox. The annoying problem with this, is that it distributes the entire certificate database. Any certificates added by the user will be overwritten.

share|improve this answer

Sam's answer is the best bet for IE.

For Firefox, it's not as easy because there's no machine wide certificate store that it uses (sadly). Each user has their own copy of the certificate store in the Firefox profile folder called cert8.db. You will basically have to edit this file with a local copy of Firefox and add your internal certs. Then distribute it to all of your users' profiles.

Distribution can be done using FirefoxADM like Zoredache mentioned. But there are plenty of other ways to do it using login scripts or tools like SMS/ConfigMgr.

share|improve this answer

I suggest using certutil from NSS Tools [1] that can administer the certificate databases used by softwares like Firefox and Thunderbird [2]:

certutil.exe -A -n <cert name> -t <trust> -i <cert filepath> -d <firefox/thunderbird profile dirpath)

Combined with PsTools's PsExec or an AD/logon script. Either way it should be ran when software is not running on remote host.

NSS Tools sources can be grabbed from (some Windows binaries can be found on the Internet but given the security nature: it's better to compile it yourself)

[1]: Network Security Services:

[2]: They are using a Netscape Communicator database with files cert8.db and key3.db.

share|improve this answer

Also in the user's profile directory there's a cert_override.txt file that gets populated when you override a certificate warning and choose to store the exception permanently. If you only have one or two certs to worry about you might want to take a look at that. Having said that, I've only used it on one server and there are a couple of encrypted strings in the file, so you might find it's machine specific...

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.