I'm hitting a wall here so need some help.

I am currently involved in a project that will require use of a third party software installed on one of our internal servers.

The software in question will be responsible for managing range of mobile devices in our warehouse and production areas. The problem is that the software vendor requires the software to use an SSL connections signed by authorised CA, self-signed certificates are not an option.

Everything will be run on internal network inside ActiveDirectory domain, with no access to outside world whatsoever.

I tried using the ZeroSSL service (which utilizes LetsEncrypt) but it's obviously no go, even using the DNS verification, since the ZeroSSL & LetsEncrypt cannot query my internal DNS for the TXT records.

So how do I get a CA signed SSL certificate on windows servers without any access to internet?

  • 1
    In general people set up an internal CA and use AD to push the internal CA’s root certificate into the trusted CA list to establish the proper trust. (Or other mechanism if not all your hosts are AD domain members) Then you can issue signed certificates as needed. - If you followed the recommended practice to use a sub domain (int.example.com) from your actual domain name example.com for your internal network and AD (and not something made up) you can still get /buy certificates signed by recognized CA even though the dns records only exist in your internal domain – HBruijn Sep 26 '19 at 14:07
  • 1
    Is your internal domain name also publicly registered? If no, can you register it? If yes, you can split DNS and use public zone for validation TXT records. – Vadim Sep 26 '19 at 15:20

how do I get a CA signed SSL certificate on windows servers without any access to internet

  • Install an internal Microsoft CA

  • Issue the certificates

  • Ensure the system with the application trusts your internal root/issuing CA

Even if you were to use an external issuing CA, it's very common to not have Internet access. In that scenario you could host the certificate revocation lists internally and configure DNS for the CRL's to use your internal list.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.