I use Google Apps For Business + SingleSignOn, that means all my users login trough an internal interface instead of though gmail.com.

This SingleSignOn open source solution uses SAML protocol (i think that is correct) to make the user login on google services. It integrates with AD, so all my users use the Windows credentials to log in e-mail.

This SSO interface needs a SSL certificate to trade information with Google Platform, problem is it is Self Signed, causing "Invalid certificate" screens, which confuses my users.

Question: Is there any way to push an certificate as "Trustable" to all users using an active directory policy? I want this invalid certificate screen to go away and I don't want to buy a certificate for only a couple of users. This SSO interface runs on APACHE and is behind firewall, available only on the Office or though VPN.


Yes, it is quite possible to push out certificate trusts to users. This is done through Group Policy. You can find it under Users -> Windows Settings - > Security Settings -> Public Key Policies. From there you can manage which certificates and certificate-authorities are to be trusted. The same hive exists on the Computer side of the GPO as well.

You'll probably find your AD CA in there, if you have one. These are quite useful for enterprise certificate-authorities.

  • Thanks alot. Do you know if it will work for all browsers or just for internet explorer? All my users use Google Chrome with Chrome for Enterprise Policy Framework - which unfortunately does not have a Policy for trusted certficates for chrome. – ddutra May 20 '12 at 15:41
  • @ddutra Yes, that should work just fine - Chrome uses the Windows certificate store for trust checking. – Shane Madden May 20 '12 at 16:12
  • Guys, thanks alot. I guess my question is anwsered. I will pass this down to my team so they make the proper changes to AD. Best regards. – ddutra May 20 '12 at 16:23
  • You would need to create the certificate with your AD CA instead of using a self-signed certificate for this approach to work. – SturdyErde May 21 '12 at 10:35
  • @SamErde Not necessarily. We did the same trick for certificates signed by a Novell eDirectory CA (which we were also pushing out via this trick). But the overall point of "it works for IE, other browsers need different approaches" is quite true, though. – sysadmin1138 May 21 '12 at 11:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.