We have a Microsoft enterprise certificate authority, and I would like to start issuing a few code signing certificates.

But what I'm unsure of is this: since all our domain/forest machines trust the internal CA, when I issue code signing certificates: will all the client systems automagically trust the code signing certs for executing any code, or do I need to add the individual users' code signing certs to the clients' "Trusted People" store (like you might do with their self-signed or third-party certs)?


If you issue the certificates using a trusted CA, then all these certificates will be trusted by your machines. You can have a look at this page.

  • That's what I suspected... thanks for the confirmation. We'll just have to be careful who we issue the code signing certs to, as they'll be inheriting a lot of power. – ewall Dec 2 '11 at 17:15

It depends... I used to think that way, but then we started using System Center Update Manager. For the cert to be trusted in this case, it needs to be added to the "Trusted Publishers" store even when it's from your CA.


  • Hmm... interesting. Guess I'll have to try it and see! – ewall Dec 6 '11 at 15:03

You want to add this to "TrustedPublishers" as well as the "TrustedRoot"


certutil -addstore "TrustedPublishers" *.cer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.