Permanent SSL Certificate Permanent Installation Using AD Group Policy

Question

Dear,

Expecting your valuable technical reference for SSL certificate for domain users using AD GPO.

We have installed SSL certificate using link(https://social.technet.microsoft.com/Forums/windows/en-US/7f3df910-7b0a-4d5c-a4c0-3f77859cbf8c/create-a-self-signed-certificate-server-2012-r2?forum=winserverTS), unfortunately when configured GPO is disabled /deleted certificate is deleted from enduser machine.

how can we permanently install ssl certificate on domain clients pc's.

Answer 1

Hello @ASAMED ,

Thank you for posting here.

To further narrow down our issue, we would like to get more detailed information. Would you please help to collect the following information:

1.Would you please tell us where your SSL certificate is from (your SSL certificate is issued from your internal CA server or from third-part CA or self-sign certificate or root CA certificate)?
2.Is your SSL certificate user certificate or computer certificate? In other word, we want to put this SSL certificate in Certificate - Current User\ Personal or Trusted Root Certification Authority?

or Certificates - Local Computer \Personal or Trusted Root Certification Authority?

3.What GPO setting do you configure?

Thank you for your understanding and time.

Best Regards,
Daisy Zhou

Answer 2

Hi Daisy Zhou,

Thanks for your response.
Requested details are mentioned below.

1. Certificate which we generated from internal server.
2. Our certificate is client authentication report & need to install as local computer trusted root certificate.

Certificates (Local Computer)--> Trusted Root Certification Authority--> Certificates.

3. We put Certificate in share folder (all users have read access) & GPO Settings are:-

Computer configuration--> Policies--> Windows Settings --> Security Settings -->Public Key Policies--> Trusted Root Certification Authorities and imported certificate.

Now certificate is installed but whenever GPO disabled installed certificate automatically deleted from user pc.

Thanks

Answer 3

Hello @ASAMED ,

Thank you for your update. I am sorry for the late reply.

If we want to install certificates as local computer trusted root certificate via GPO, the GPO setting you mentioned is correct.

Do you mean disable GPO as below, right click GPO object and uncheck "Link Enabled"? If so, once we disabled GPO, the GPO will not apply, I mean installed certificate will automatically deleted from user pc. This is an expected behavior.

But why do you want to disable GPO with installing certificates as local computer trusted root certificate setting?

Best Regards,
Daisy Zhou