Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Pushing down certificates using AD into user personal certificate store

Posted on 2014-03-19
8
Medium Priority
?
587 Views
Last Modified: 2014-05-20
Hi Experts,

How can we push a third party client authentication certificate (used for 2 way SSL) using AD to a user's personal certificate store?
0
Comment
Question by:arunmagic
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
8 Comments
 
LVL 33

Expert Comment

by:Dave Howe
ID: 39939736
Yes. Certificates in the user's personal store are just registry keys, so can be pushed using group policy.

HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates

(system certificates are in a similar place on HKLM)

note, these are just the certificates, not including private keys.
0
 

Author Comment

by:arunmagic
ID: 39939747
How do we push down the certificates and privake keys (like in a pfx file)?
0
 
LVL 33

Accepted Solution

by:
Dave Howe earned 1500 total points
ID: 39939804
if you need to push those, I think you are more likely to want to look at using a login script and something like CertUtil - there is a way to do this with powershell too, but its pretty complex (requires you to call the applicable dotnet libraries directly) so a batch file with certutil is probably your easiest route.
0
Supports up to 4K resolution!

The VS192 2-Port 4K DisplayPort Splitter is perfect for anyone who needs to send one source of DisplayPort high definition video to two or four DisplayPort displays. The VS192 can split and also expand DisplayPort audio/video signal on two or four DisplayPort monitors.

 

Author Comment

by:arunmagic
ID: 39939824
So where do I keep the certificates in this case?
0
 
LVL 33

Expert Comment

by:Dave Howe
ID: 39939873
pfx files? probably on the NETLOGON administrative share on the domain controllers (which is the classic location for login scripts and their attendant administrivia)
0
 
LVL 62

Expert Comment

by:gheist
ID: 39940404
Why sould you ever see user's provate key? Why you want  to compromise your security by issuing users your private keys?
0
 
LVL 33

Expert Comment

by:Dave Howe
ID: 39941786
@gheist:
  There are times that is advisable - certainly, if the key is used for business purposes, you will want a recovery mechanism in place in case the device crashes, the employee leaves or any other case where the employee is unwilling or unable to unlock data secured to that key.

  None of that prevents the user creating and using their own keys for private/personal purposes.
0
 
LVL 47

Expert Comment

by:Donald Stewart
ID: 39978338
Here's how I do it:

Create a share and place capicom.dll and cstore.vbs in it

Then a logon script with the following

@ECHO OFF
if exist c:\windows\system32\capicom.dll goto next
:copy
copy "\\server\certificates\capicom.dll" "C:\windows\system32\"
:next
regsvr32  /s capicom.dll
cscript \\server\certificates\CStore.vbs import \\server\certificates\cert1.pfx P@ssword
cscript \\server\certificates\CStore.vbs import \\server\certificates\cert2.pfx P@ssw0rd

more here

http://www.visualbasicscript.com/m37106-print.aspx
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Windows Server 2003 introduced persistent Volume Shadow Copies and made 2003 a must-do upgrade.  Since then, it's been a must-implement feature for all servers doing any kind of file sharing.
In the absence of a fully-fledged GPO Management product like AGPM, the script in this article will provide you with a simple way to watch the domain (or a select OU) for GPOs changes and automatically take backups when policies are added, removed o…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…
In this video, viewers are given an introduction to using the Windows 10 Snipping Tool, how to quickly locate it when it's needed and also how make it always available with a single click of a mouse button, by pinning it to the Desktop Task Bar. Int…

688 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question