Deploying internal certificate via GPO - will this only work for IE?

Question

I am contemplating adding AD CA role to our server and using GPO to add a self signed, trusted certificate to all internal clients (to ease testing)... Some of the related questions regarding this are:

• How do I deploy an internal certificate authority?
• In-house Trusted Certificate

My question is, will using GPO to "push" self signed cert only work for Internet Explorer or will it work for any browser from clients? Also, will it allow client trusts in case of non-browser applications (such as web service clients)?

Solution

It will make Windows any clients joined to your domain trust your certificate authority as a Trusted Root CA, so any certificates your CA issues are automatically trusted by your computers. Anything that asks Windows if a certificate is trusted will trust the root certificate, but not all browsers do this.

For example, Internet Explorer will trust the certificate, as will Outlook (for example an Exchange AutoDiscover certificate) however Firefox does not trust the certificate and holds its own list of trusted certificates. It all depends on individual browser implementation I'm afraid.

Normally you can import trusted root certificates into an application if it uses its own list of trusted certificates, but again this is implementation dependant.

Comments

[zam6ak]

:( I was afraid this may be the case...I was hoping there would be a way where any internal client would not be prompted with invalid cert dialog but it seems like the only way to do so it to actually buy a cert from CA that is in the trust chain which already exists in all (or most) browsers...

[Ben Pilbrow]

Yeah I'm afraid so. We have an enterprise root CA securing some intranet resources and I know the pain this causes with browsers other than IE. Unfortunately, like you said the only real solution is to get a certificate signed by a root CA which is trusted by all major browsers.

[ThatGraemeGuy]

Not strictly correct. Yes, IE any many other applications will trust your internal CA and any certs it issues, but there are apps that maintain their own list of trusted roots, notably Firefox.

[CarloBaldini]

So I have learned today :-) Although I wonder how unique Firefox is in this regard. Chrome certainly uses the computer's Certificate store.