0

Due to a recent Google change, one of the SSL certificates for our URL & Content filtering systems keeps throwing an error preventing users from accessing this specific site. The fix is to just delete the certificate which we have been doing but it keeps reinstalling after we delete it. I am assuming when the users desktop reboots, it communicates with the CA server and it installs again. Can I block this specific certificate? The only other fix is to upgrade our URL & Content filter to a new version but we had just finished upgrading to this new version a few weeks ago.

How do we prevent the certificate from installing again after we delete it?

Improve this question
1

1 Answer 1

Reset to default
1

The first step is figuring out how this is happening.

  1. Is the content filtering system pushing the certificate to clients using a set of credentials?
  2. Is the certificate being pushed by GPO?
  3. Is the certificate published in Active Directory? (not the same as a GPO---must check both)
  4. Is there a service/app running on the clients that could be reloading it?

Once you know how the certificate is being distributed, you can look at reconfiguring the distribution method.

Alternatively, you can push the certificate into the Untrusted store via Group Policy, which should prevent clients from using it. This is effectively the same thing as deleting it from Trusted store---in most cases. Obviously, you will need a valid certificate in order for your content filter to work.

Last, but not least: Can you figure your content filter to ignore traffic to the affected site? If its decryption or inspection of that traffic is causing problems, you should be able to whitelist the site so that it is left alone. Most enterprise solutions include this capability.

Improve this answer
2
  • We believe it is a GPO pushing it out after we remove it. The thing is we cannot locate it and we do not have access to make any changes. I found a Local Policy but after we run gpupdate it puts the Certificate back.
    – HannibalBarca
    Apr 2, 2018 at 16:00
  • You will have to run RSOP.msc on a client. In the resultant policy window, navigate to certificate config, and it should list all policies that applied those settings. Your domain admins should be able to review those items and edit the relevant policy easily once you give them the name(s).
    – DoubleD
    Apr 2, 2018 at 16:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .