Is it possible to simplify or automate certificate install

[TwistedHelixis]

Our LA require a certificate to be installed to access the internet, which is fine for any domain joined systems but we have a number of external companies come in to run courses and those certs need to be installed manually.

 

I have just been informed that the school have a company coming in on Sunday and need internet access. I have created a little step by step, but having worked in the IT sector for many many years can see someone still getting these simple instructions wrong.

 

Does anyone have any ideas about either simplifying the install or somehow automating it.

 

Cheers

[InterwebsGuy]

Our LA require a certificate to be installed to access the internet, which is fine for any domain joined systems but we have a number of external companies come in to run courses and those certs need to be installed manually.

 

I have just been informed that the school have a company coming in on Sunday and need internet access. I have created a little step by step, but having worked in the IT sector for many many years can see someone still getting these simple instructions wrong.

 

Does anyone have any ideas about either simplifying the install or somehow automating it.

 

Cheers

 

I'm guessing this is an HTTPS interception certificate?

We have a similar issue with the one our Smoothwall uses. It's a real pain with non-domain joined devices and any unmanaged iPads / mobile devices that come in.

[TwistedHelixis]

Yes, this is for HTTPS interception.

 

If doing this manually, I cant just use the defaults when installing the cert, I need to pick 'Local Machine', and then the root cert etc, which I am sure non technical people will get wrong in some way.

[InterwebsGuy]

Yes, this is for HTTPS interception.

 

If doing this manually, I cant just use the defaults when installing the cert, I need to pick 'Local Machine', and then the root cert etc, which I am sure non technical people will get wrong in some way.

 

I understand, it's the same concern I have. For example, it makes us having a Guest and BYOD Wifi network pointless to an extent, as most people struggle with adding the certificate in.

[Arthur]

We have a similar issue with the one our Smoothwall uses. It's a real pain with non-domain joined devices

If doing this manually, I can't just use the defaults when installing the cert, I need to pick 'Local Machine', and then the root cert etc, which I am sure non technical people will get wrong in some way.

For BYOD Windows devices, I created an MSI for the distribution of our HTTPS Interception certificate to make it easier to install by end users.

 

I have attached the source code used to generate it if you want to give it a try? Here are some basic instructions...

 

1. Download and install the latest WiX Toolset.
    
    
   
2. Download the .zip file attached to this post. Unblock it and then unzip to a folder.
    
    
   
3. Copy your HTTPS certificate into the 'Source' subfolder. Delete the example certificate.
    
    
   
4. Open Product.wxs in a text editor.
    
   
   • Modify the ProductName on line 6. e.g. Smoothwall HTTPS Certificate
     
   • Modify the Manufacturer on line 7.
     
   • Replace ExampleCert.crt with the filename of your certificate on lines 39 and 47.
     
   • Save.
     

 

[*]Open Installer.wixproj in a text editor.

 

• Change 'HTTPS Certificate' on line 9 to whatever you want to name the actual .msi file.
  
• Save.
  

 

[*]Run _Make.cmd to generate the MSI. This will be saved in the .\Deploy\Release subfolder.

 

 

[*]Optional. If you have a code signing certificate from a public CA, digitally sign the MSI.

Note. If you ever need to distribute a newer version of the certificate in the future, just overwrite the certificate file, increment the version number in _Make.cmd & Installer.wixproj and run _Make.cmd again. The generated MSI should automatically uninstall the old certificate and install the new one (as long as the UpgradeCode is identical).

 

any unmanaged iPads / mobile devices that come in.

For unmanaged BYOD iOS devices I created a .mobileconfig file containing the certificate. After the user has installed the configuration profile they just need to going into Settings to trust it (see link below).

 

https://support.apple.com/en-gb/HT204477

HTTPS Certificate v1.0.0.0 (WiX).zip

[TwistedHelixis]

For BYOD Windows devices, I created an MSI for the distribution of our HTTPS Interception certificate to make it easier to install by end users.

 

I have attached the source code used to generate it if you want to give it a try? Here are some basic instructions...

 

 

 

 

For unmanaged BYOD iOS devices I created a .mobileconfig file containing the certificate. After the user has installed the configuration profile they just need to going into Settings to trust it (see link below).

 

https://support.apple.com/en-gb/HT204477

Thanks for taking the time to post that. I'll give that a go next week. [emoji1]

[dapaulio]

For speedy fix and short term You could create a batch file along with the certificate containing the following code on a couple usb pen drives. And hand them to your guests

certutil -addstore "Root" %~dp0\cacert.cer

 

Long term fix you could create the msi as suggested above. I too will be looking in to this as this will help in my environment. Thanks

[TwistedHelixis]

Thanks, the little batch file was handy for a quick fix.