8

I have a root CA which is standalone and I have subordinate CA which is domain joined. I recently renewed the certificate of my root CA and sub CA. How do I push these certificates in the trusted root certificate store on client machines.

1
  • What OS and software are the client machines running?
    – kasperd
    Jun 25, 2014 at 19:50

1 Answer 1

12

There are two methods. You can either use Group Policy to distribute the certificates to domain clients, or you can use certutil.exe -dspublish -f <certfilename> RootCA. There are advantages to either method. The dspublish method is simpler, but the Group Policy method is a bit more flexible. Using Group Policy, you can scope the recipients of the certificate(s) to certain OUs, configure extended properties like Extended Validation, OCSP responders, etc.

enter image description here

http://technet.microsoft.com/en-us/library/cc782744(v=WS.10).aspx

OR

enter image description here

But you do not need to do both.

1
  • What is the precise method to export the certificate to <certfilename> - what is the correct format?
    – Daniel K
    May 17, 2023 at 20:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .