I have a root CA which is standalone and I have subordinate CA which is domain joined. I recently renewed the certificate of my root CA and sub CA. How do I push these certificates in the trusted root certificate store on client machines.

  • What OS and software are the client machines running? – kasperd Jun 25 '14 at 19:50

There are two methods. You can either use Group Policy to distribute the certificates to domain clients, or you can use certutil.exe -dspublish -f <certfilename> RootCA. There are advantages to either method. The dspublish method is simpler, but the Group Policy method is a bit more flexible. Using Group Policy, you can scope the recipients of the certificate(s) to certain OUs, configure extended properties like Extended Validation, OCSP responders, etc.

enter image description here



enter image description here

But you do not need to do both.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.