1

Consider the following scenario, keeping in mind the restrictions:

  • Your goal is to secure intranet-only web applications to start using https - so you need a certificate issued, so you can bind it to your web server
  • You have to use a certificate issued from a non-global Certificate Authority (CA) that is provided to you
  • You have users who need to connect to your intranet via VPN - so they are connecting from computers that don't recognize this CA as trusted
  • You can't force all your VPN users to manually install the CA you're using as a "Trusted Root Certification Authority"
  • Active Directory is set up on the network, and it's currently known to be possible to propagate certificates to users within the intranet, using Group Policy Objects (GPO) - which can be edited via mmc.exe on Windows Server

Do VPN users automatically download certificates from group policy objects? If not, is it possible to use GPOs to get VPN users to trust this CA automatically by propagating certificates, and how? If not, are there any alternative solutions?

Ultimately, how can one make sure that VPN users won't get browser warnings (ERR_CERT_AUTHORITY_INVALID on Chrome) when they attempt to access intranet applications in this scenario?

Improve this question

1 Answer 1

Reset to default
1

In principle your comments about the VPN are not central to answering the question, as VPN functionality is to create a network tunnel and not usually to automate configuration of the client PC. Using AD GPOs is a method of distributing keys to users and as long as they are members of AD, an appropriate GPO will have the effect of loading the right certificates on client systems (AD domain members). This happens regardless of whether they use a VPN or not, though if the VPN is the only means of connecting a client to AD servers then it is needed for the GPO to work. Note that GPOs do not work instantaneously, meaning they require certain events to happen to have effect.

The right order of steps is:

  1. Create your local CA infrastructure and certificate keys
  2. Setup intranet sites with https and server authentication certificates
  3. Create an AD GPO to distribute appropriate client side certificates to user systems
  4. Allow client PCs to connect to AD to consume the GPO and get the keys (whether through VPN or normal LAN access)
  5. Users will now be able to trust website certs used on your intranet
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .