SSL Certificate distribution

[#1]

Hello Experts,

We are in process of setting up portal with ESS/MSS - NW04s SP17, enabled system for SSL. We are using self signed certificate. Now whenever user accesse the portal, they get pop up message - until they install certificate.

Issue is, for PRD system we will have large user base, and its difficult for end users to install the certificates.

Can someone share, how can we automatically deploy/distribute certificates to large community of end users, so that end users should not get the pop up message.

Thanks

Davinder

[Former Member]

Thanks

[hofmann]

Hi,

how you can avoid this browser behaviour depends on your setup

- Best way is to get your server's certificate signed by a trusted CA whom's Root Certificate is already installed in the browser (eg: Verisign, godaddy).

- If your end-users are on Windows + AD: your AD-Administrators can distribute the Enterprise Certificate or the servers certificate via AD Group Policy. That will install the certificate on all clients in the AD.

br,

Tobias

[Former Member]

hello Tobias,

Thanks for the update.

Would appreciate if you can provide some documentation on distributing Enterprise/Server certificates via AD Group Policy.

Best Regards

Davinder

[hofmann]

Hello Davinder,

the best resource for depolying certificates in windows is Microsoft or your infrastructure team.

KPI: http://technet.microsoft.com/en-us/library/cc756957.aspx

Group Policy Management Console: http://www.microsoft.com/windowsserver2003/gpmc/default.mspx

GPO:

http://en.wikipedia.org/wiki/Group_Policy

http://technet.microsoft.com/en-us/windowsserver/grouppolicy/default.aspx

br,

Tobias

[Former Member]

Thanks Tobias for sharing valuable information.

Would appreciate if you can confirm :

If the Enterprise Certificate Server is down, EP application will not be effected as there is no communication between application and Enterprise Certificate Server.

Thanks

Davinder

[hofmann]

Hi,

certificates are stored offline at the client. Therefore, when the PKI / CA goes down, the Browser still can validate the server's certificate. You'll get only trouble when the certificate reaches it's "valid to" time.

br,

Tobias