SSL Certificate issue

[SFW]

Dear Team,

I would like to seek your support regarding SSL certificate deployment.

I have added the firewall SSL certificate into the AD server via Group Policy, but it seems not to be working as expected. Currently, the only way users are able to access the internet is if I install the certificate manually on each workstation.

Since we have 3 branches with AD hosted in the DC, and more than 500 users, it is not feasible to install the certificate manually on every system. I need to ensure this certificate is deployed successfully via Group Policy so that all users automatically receive it.

Could you please assist me in resolving this issue?

Thanks in advance for your support.

Best regards,

[Markus_M]

It isn't clear what you're trying to do here. Please take some time to describe your use-case and what you're trying to achieve, otherwise it is guesswork that won't help you

- Deep inspection?
- VPN Certificate authentication from client to server
In case of DPI, you need to install the CA certificate to the firewall, the one that signed the SSL certificate. This must be done via GPO. If you ensured the users have it, you might have installed it to the wrong store. Proof: You install it manually, which apparently achieves a different result to what the GPO method did.

In case of VPN certificates per user (which is what it sounds like) - the Windows CA certificate authority must generate individual client certificates and push them via GPO. You can push them as machine or user certificates. If the user has no machine certificate access due to permissions, the authentication won't work.

Both assumptions are completely different topics and you might be meaning something completely different. So please explain.

General advice, aside from certs, GPO etc... :

If your automated method isn't working, but the manual method, that shoud achieve the same result, is working - then what are the exact results of the automated version - how do the results differ to the manual way? That would usually point you to the automated version being done incorrect. Wrong target, not (yet) executed, wrong container, wrong data pushed etc.

[SFW]

Hi Markus,

Thanks for your response.

Let me explain the situation more clearly: whenever I try to push the Fortinet certificate through Group Policy, it should automatically install for all users in that policy. In my case, I have 3 branches, and the AD is located in the Data Center.

For one of the branches, I was able to install the SSL CA certificate via Group Policy, and it was deployed automatically to the users. However, when I try the same process in another branch, the certificate does not get installed, and users face certificate issues.

I tested manual installation, and it works fine, but the automated deployment through GPO is not working for that branch.

Thanks.

[Markus_M]

I'm still unsure - what do you want to install the CA certificate for? Deep inspection?

If automated does not work, is the automation target incorrect?