I use Google Apps For Business + SingleSignOn, that means all my users login trough an internal interface instead of though gmail.com.
This SingleSignOn open source solution uses SAML protocol (i think that is correct) to make the user login on google services. It integrates with AD, so all my users use the Windows credentials to log in e-mail.
This SSO interface needs a SSL certificate to trade information with Google Platform, problem is it is Self Signed, causing "Invalid certificate" screens, which confuses my users.
Question: Is there any way to push an certificate as "Trustable" to all users using an active directory policy? I want this invalid certificate screen to go away and I don't want to buy a certificate for only a couple of users. This SSO interface runs on APACHE and is behind firewall, available only on the Office or though VPN.