Our corporate machine administrators distribute corporate root CA certificates via Active Directory, but Chrome does not trust system certificates by default. Is there any way to tweak Chrome to trust those certificates, instead of manually add them to Chrome CA store? I know we can do this in Firefox, so I think it may also be possible for Chrome.


I know how to add them to Chrome CA store. I want to know whether there is a way to directly ask Chrome to trust system trust store. I tagged this question with Windows because I mainly works on Windows (with Active Directory), but it would be good to know whether Chrome can trust macOS Keychain Access, or /etc/ssl/certs on Linux.


I have verified that currently Chrome will respect any certificate in Windows system trust store. This question is now meaningless. Thanks everyone.

  • Similar question....stackoverflow.com/questions/7580508/… – Moab Apr 20 '18 at 22:12
  • @Moab None of the answers mentions system certificate manager. If you are talking about adding the root CA certificate to Chrome store, yes I know how to do that and I know what that means. I updated the question to clarify. – Franklin Yu Apr 21 '18 at 4:02

Chrome uses the Certificate Store on Windows for validating certificates. If Chrome is complaining, then the certificate is not installed on Trusted Root Certificates on your local machine or the certificate's CN (Common Name) is not matching with the domain name you are accessing.

In order to install the certificate on trusted roots,

  • Click on the red alert icon on the top left of the address bar, form drop down menu select certificate.

  • Then navigate to the detail tab on the certificate window, from bottom right click on Copy to File, Export the certificate in DER encoding set the name of the certificate and Finish.

  • Then open certmgr.msc expend the Trusted Root Certificate Authorities tree.

  • Right click on Certificate from the drop down select all task then click import select your certificate chose Place all certificates in the following store and proceed to finish.

  • Relaunch Chrome.

If this doesn't solve your problem, there is an issue in the certificate or someone trying to gets in the middle (Man in the Middle Attack)! concern your system administrator.

Reference: https://www.techrepublic.com/article/how-to-add-a-trusted-certificate-authority-certificate-to-chrome-and-firefox/

|improve this answer|||||
  • 2
    It's no longer CN; Chrome switched to using only SAN (the SubjectAlternativeName extension) about 2 years ago. (All browsers for at least 10 years support SAN over CN, but as of now only Chrome requires it.) – dave_thompson_085 Jan 13 '19 at 14:50

If you Have the Cert. already in exported form I want to say pkcs 7 you should just be able to import the Cert into Chrome by going

Settings>Advanced>Manage Certificates>Trusted Root CA>Import

If that doesn't work you could also try Importing the Cert into Windows Cert manager by opening

MMC.exe>File>Add/remove snapin>Certificates>OK>Trusted Root CA>"Action" tab>all tasks>Import and follow the wizard

|improve this answer|||||
  • I know how to import cert to Chrome from Chrome Setting. I want Chrome to trust system setting so that it automatically trust any certificate in the Windows Cert Manager once my admin updates it through something like Group Policy. – Franklin Yu Apr 21 '18 at 4:10
  • @FranklinYu This should be possible with the enterprise version of chrome from the admin profile using google chrome's group policy, But sadly from looking at the settings for chrome and reviewing all the options in Chrome://flags I have found no luck. – Just Curious Apr 23 '18 at 22:14

I suggest you that You can Import that Certificate in Your Web-Browser but to Universally available this certificate for Everyone it may take some time that's why Web-Browser Delivers Update to users.(These Update include CA Authorities's Signature Certificates).

In order to install your new SSL certificate, you need the following information:

Certificate Private key Intermediate certificate (Typically supplied in a separate file from the vendor) Once you have this information, you can install your new certificate by clicking on the Security tab of your site, then clicking on the Edit Certificate link.

On the next screen, there are three fields for Certificate, Private Key, and Intermediate Certificate. Replace the current information with your updated info, and then click Save.

DNS Update:-

Because you are updating an existing SSL certificate, you don’t need to wait for propagation as you would when installing a new SSL certificate.

|improve this answer|||||
  • I guess this is pasted from some online articles because the wording is somewhat confusing. If so please cite the source of the article. And, welcome to SuperUser. – Franklin Yu Apr 22 '18 at 2:08
  • Thanks, and Yes Sir I am new to SuperUser and I want to be a SuperUser Contributor like You. – dx.hmnt Apr 23 '18 at 4:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.