Trusted Publishers certificate store

Question

Hello everyone,

In order to authenticate my users Cisco VPN connection based on a Self Signed certificate installed on their PCs, I have created a GPO with the certificate imported into the Trusted Publishers store and I can see it perfectly applies on all computers with no issues. The problem is that in order to authenticate my users against this certificate I need to scan their PCs registry key for the certificate, which does not exist when I install the certificate through GPO but if I install the certificate using certificate management console and import it manually, it generates the certificate registry key and then I am able to authenticate with no issues. Does anybody know why the GPO does not generate the needed registry key as the manual import does?
On the other note I tried using PS scripts to import the certificate which created the registry key but I am trying to avoid using scripts due to Execution Policy settings on our company computers.
Here is the registry key path:
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates
Thanks,
Ramin

Answer 1

Hello @Ramin Zamani ,

Thank you so much for your update.

I only have time to test your problem in my test environment now.

Then I got the same result as you.

But I have new finding, the installed the certificate through GPO has changed the following registry instead of the one you provided.

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates

Here is result in my lab.

You can check on your machine.

Hope the information above is helpful.

Should you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 2

Hello @Ramin Zamani ,

Thank you for posting here.

Based on the description above, I understand you have Self Signed certificate for your users Cisco VPN connection, and you want to install this certificate to all their store via GPO.

1-But would you please tell me what the type of this certificate is? I mean whether this certifcaite is issued to a user certificate or this certificate is issued to a machine certificate?

2-If it is a machine certificate, so you have configured gpo under Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Public Key Policies ->Trusted Publishers, is it right?

1.Create an OU and put the machines to this OU.
2.Create a GPO and link this GPO to OU above.
3.Edit GPO Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Public Key Policies ->Trusted Publishers
4.Restart the machine in OU above to see certificate is installed in Trusted Publishers
5.But the value of the registry Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates is not changed, is it right?

3-Based on the description "but if I install the certificate using certificate management console and import it manually, it generates the certificate registry key and then I am able to authenticate with no issues.", do you import the certificate to Personal store or Trusted Publishers store under "Certificates - Local Computer" or Personal store or Trusted Publishers store under "Certificates -Current User"?

Should you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

Answer 3

Hello Daisy,

Here are my answers:

1- I have imported the certificate to Trusted Root Certificate Authorities and Trusted Publishers stores under Computer Configuration.
2- Yes, it is correct. 2-5: It is correct.
3- I import the certificate under "Certificates (Local Computer)" - "Trusted Publishers"

Thanks,
Ramin

Answer 4

Anybody can help in this matter? I am stuck in this. I even tried to add the certificate by using a script but the commands in the script need to be ran as Administrator and so it does not affect the certificate store or registry. Any help is appreciated.
Ramin

Answer 5

Hello @Ramin Zamani ,

Thank you so much for your update.

As far as I know, either we use user VPN certificate or we use computer VPN certificates.

If we use user VPN certificate, we put cert in user store.

If we use computer VPN certificate, we put cert in machine store.

And for the existing cert, we need to export it to user/ machine store manually.

Hope the information above is helpful.

Should you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.