Solved

How can I install a .pfx ssl certificate so that all users in a citrix / terminal services environment have access to it?

Posted on 2009-07-15
10
8,868 Views
Last Modified: 2013-12-08
Hello all. I need to install a .pfx certificate for all users. The
problem: when I install it, it is only available for the user who
installed, not for the rest.

Can this be done installing the .pfx one time only, or do I have to
install the same certificate for EVERY user??? If so, any ideas about how
can I automate the installation of the certificate for every user?

The environtment is W2K3-SP2, CPS4.5.
0
Comment
Question by:ppsdit
  • 4
  • 4
10 Comments
 
LVL 14

Accepted Solution

by:
amichaell earned 250 total points
ID: 24868644
We use certutil to import our certificate.  We're doing a .cer, though you should be able to do a .pfx as well.  Upon user logon a batch file executes with the command below.  

c:\certutil\certutil.exe -addstore root c:\certutil\svcert.cer

You'll need to modify the paths at the least.
0
 
LVL 36

Assisted Solution

by:Carl Webster
Carl Webster earned 250 total points
ID: 24868656
Follow these instructions to import the .pfx file

open mmc, (start>run>mmc) and open the certificates snap in.

Select "local computer account" when prompted

You will then see on the left, certificates, please select the "personal" folder.

Right click the "personal" folder and select all "tasks>Import"

Find the .pfx file you saved previously and import the certificate and private key into the MMC
0
 

Author Comment

by:ppsdit
ID: 24871543
Carl, Thank you for your insight.  I am a bit confused however, where are you suggesting that I run this procedure?  On each citrix server?  Would that be available for all users?

Thanks
0
 
LVL 36

Expert Comment

by:Carl Webster
ID: 24871639
Yes, on each Citrix server.  Since you are using the local computer it _should_ install for all users.  I have seen other Citrix foum postings that say this will need to be done for every user.
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 

Author Comment

by:ppsdit
ID: 24873389
Unfortunately I do not see the cretificate in IE when I install it the way you described, Carl.  And when I go to the site Ithat the cert is for, it says it can't find a certificate.
Any idea why that might be?
0
 

Author Comment

by:ppsdit
ID: 24875249
the following script works perfectly:
c:\windows\system32\certutil -user -p password -importpfx -f \\server\path\cert.pfx
however it only works for local/domain administrators.

When I try running this as a logon script via group policy it does not correctly add the certificate to the personal store of the local user (and there is no enty in the certutil.log file).
When I try running as an admin user it does not seem to add the cert to the personal store.

Any advice would be greatly appreciated.

thanks,
0
 
LVL 36

Assisted Solution

by:Carl Webster
Carl Webster earned 250 total points
ID: 24897964
Try CAPICOM from Microsoft:

http://msdn.microsoft.com/en-us/library/ms995332.aspx

then use the cstore.vbs in a batch file to import the certificate.
0
 
LVL 36

Expert Comment

by:Carl Webster
ID: 24898012
0
 

Author Comment

by:ppsdit
ID: 24928249
Thank you for your suggestions.  In the end, I couldn't spend much more time on this.  The CAPICOM option seems promising but I decided I needed to find a different solution.
This is what I did:
I downloaded a fully encpsulated thinapp version of firefox from thindownload.com
I am easily able to manually add the certificates to each users' profile in firefox (I was able to do so in IE but the page would not display properly).  I have not yet figured out how to do so with a script but since I was just going to publish that thinapp via citrix to about a dozen users, so I did it manually this time.  Thank you for all your help.

0

Featured Post

Scale it in WD Gold

With up to ten times the workload capacity of desktop drives, WD Gold hard drives employ advanced technology to deliver among the best in reliability, capacity, power efficiency and performance.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

If you are a web developer, you would be aware of the <iframe> tag in HTML. The <iframe> stands for inline frame and is used to embed another document within the current HTML document. The embedded document could be even another website.
This article explains in simple steps how to renew expiring Exchange Server Internal Transport Certificate.
How to install and configure Citrix XenApp 6.5 - Part 1. In this video tutorial we have explained step by step installation of Citrix XenApp 6.5 Server on Windows Server 2008 R2 is explained in this video. We have explained the difference between…
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, just open a new email message. In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…

861 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

25 Experts available now in Live!

Get 1:1 Help Now