I'm managing a Active Directory domain with about a hundred Windows 7 clients running IE9. The network does not have access to the Internet, but do have the ability to access a vendor web application. The web app uses HTTPS and the vendor's certificates are from Entrust. I'm trying to figure out how to add the certificates to Active Directory so that all clients will receive the certificates and stop warning or outright blocking access to the application. Nothing I have tried has worked.

  1. Accepting the certificates via the browser's red shield in the address bar hasn't worked. In fact, If I view the certificate and look at the path, it says it is valid, but still warns on some clients and blocks on others.

  2. I tried importing the certificates into the browser by going into Tools-Options-Content-Certificates, but that hasn't helped either. I can see the current certificates installed, but browser behavior is unchanged.

  3. Last but not least, I've added the certificates to the domain group policy under Computer Configuration - Policies - Windows Settings - Security Settings - Public Key Policies - Trusted Root Certification Authorities.

I'm losing my mind on this issue. I know the certs are good because I've installed them in the browsers for our Linux workstations without any issue. It is only the Windows hosts that will not seem to accept them. I'm wondering if the issue might have something to do with the PCs being unable to double check the certs over the Internet. I simply would like all of the domain PCs to accept the certs provided by the domain and leave it at that. I don't want to disable certificate checking completely, but I'm getting close.

Also, would setting up a certificate authority on the LAN help or just add unnecessary complexity?

  • Have you read this by chance? – Ramhound Jan 22 '15 at 14:49
  • So you have access to the internet but you block it acept this web app? Or does the web app runs on a local installation? Btw what exactly does the warning say? I cant verify the trust chain? – Ivan Viktorovic Jan 22 '15 at 15:27
  • Yes we have Internet access, but all access is blocked to the client systems. Its a lab environment and they want the clients as isolated as possible. The vendor app and one or two other services being the exception. I think the issue was with the chain, but never saw any specific error message stating as much. I'm not a Windows admin by any stretch, so I probably just missed it. I did resolve my issue to some extent and will post that. – DFarland Jan 23 '15 at 15:20

The underlying cause of my problem was that root certificates for Entrust, the CA the vendor uses, were not in the Trusted Root Certification Authorities store. I just happened to notice they were missing after scanning through the TRCA for the hundredth time. I believe the client's inability to access the Internet and verify the certs with Entrust directly was the real issue. After downloading Entrust's root certificates and adding them to the store, the issue went away.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.