Can I use some integration of Windows Active Directory and a Certificate Authority to embed a client certificate in a browser that will be trusted by a server?

I have a private domain and control over who can login. Is it reasonably possible and secure to have, upon login, a client-side cert installed such that the browser can take advantage of it and provide it when logging into specific sites (also on my network).


You can use Group Policy to install the certificate on the client machines. You will need to bind the certificate to your site through IIS/Apache to complete the process. Keep in mind that you will need to ensure that your internal CA is trusted by your internal clients.

I think this is in fact reasonably secure, and one of the use cases that Certificate Services was designed to accommodate.

Here is a link from MSDN detailing the specifics of implementing such a system: https://msdn.microsoft.com/en-us/library/bb727098.aspx

  • Thank you for the insightful answer and links. Appreciate it. – Bill Noto Feb 11 '15 at 2:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.