Maintaining Digital Certificate Security

Re:Maintaining Digital Certificate Security by jlgaddis on Monday March 23, 2015 @06:32PM (#9253747)

> But enterprises don't need delegated CA=TRUE certificates to accomplish this. They can just roll their own self-signed root CA=TRUE certificate and built it into their machines. There is no reason a CA should need to put the entire Internet at risk solely for the convenience of a single company's IT operations.

Doing it this way, however, means that they don't need to worry about pushing their self-signed certificate out to all their machines, right?

That could be done easily with group policies on Windows machines which would take care of, at least, Internet Explorer. I haven't used a Windows machine in a long time, though, so I'll ask: do the other major browsers use the built-in certificate store? If not, they'd still have to address the problem of getting their self-signed certificate "trusted" by Firefox and Chrome, for example.

[ Parent | on HN ]

Re:Maintaining Digital Certificate Security by NeutronBoy on Monday March 23, 2015 @06:44PM (#9253804)

Chrome does, Firefox doesn't. I'm not sure if there's a way to mass-push certs to FF with AD

[ Parent | on HN ]

Re:Maintaining Digital Certificate Security by omh on Monday March 23, 2015 @07:27PM (#9253979)

Not directly via AD. But you can add it to the certificate database in the template Firefox profile.

[ Parent | on HN ]

Re:Maintaining Digital Certificate Security by gcp on Monday March 23, 2015 @06:38PM (#9253777)

Firefox does not use the built-in certificate store. Mozilla has their own trusted CA list.

[ Parent | on HN ]