Consider the following scenario, keeping in mind the restrictions:
- Your goal is to secure intranet-only web applications to start using https - so you need a certificate issued, so you can bind it to your web server
- You have to use a certificate issued from a non-global Certificate Authority (CA) that is provided to you
- You have users who need to connect to your intranet via VPN - so they are connecting from computers that don't recognize this CA as trusted
- You can't force all your VPN users to manually install the CA you're using as a "Trusted Root Certification Authority"
- Active Directory is set up on the network, and it's currently known to be possible to propagate certificates to users within the intranet, using Group Policy Objects (GPO) - which can be edited via mmc.exe on Windows Server
Do VPN users automatically download certificates from group policy objects? If not, is it possible to use GPOs to get VPN users to trust this CA automatically by propagating certificates, and how? If not, are there any alternative solutions?
Ultimately, how can one make sure that VPN users won't get browser warnings (ERR_CERT_AUTHORITY_INVALID on Chrome) when they attempt to access intranet applications in this scenario?