When connecting a managed networked device (printer, router/switch, PC based software service) to a domain, mostly these days it has a https management or user access web portal. When viewing these web pages from a browser it will complain about the device not having a trusted certificate - usually because it is self-signed (by itself).

What is the best protocol for removing this warning for an internal staff accessed situation?

  1. Tell the users to add the certificate permanently to there local browser store.
  2. Replace the certificate on the device with a self signed certificate issued by the domain controller - (which presumably the domain users computers will accept due to chain of trust?)
  3. Add the device's self-signed certificate to the domain controller store - (which again presumably the domain users computers will accept? )
  • If you have a corporate PKI (for example, built with ADCS), then you should replace self-signed certificates on devices with ones from corporate CA. BTW, certificate server shall not be installed on domain controller, you should use separate host for certificate server. – Crypt32 Nov 20 '18 at 5:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.