Configuring Macs from Mac Server with the Smoothwall certificate for HTTPS inspection

[CyberDrac]

My colleague is trying to deploy the certificate from the Smoothwall from the Mac Server, but in the section where he is trying to add it the interface is insisting the private key file is dragged and dropped over before the certificate file is dragged over. Has anyone else tried to deploy the certificate from the Mac Server in their network, or is there a preferred and known working method of deploying it?

[slancaster]

Bump!

exact same query here.

For now we have used ARD to push out the smooth wall cert, then a terminal command to add cert to system keychain (not user) and then pushed out a .plist to "always trust" the cert, and then disabled the nag screen box in smooth wall for HTTPs inspection.

 

Ideal option is to have the cert on my mac server tho but ive had no joy, even tried re-exporting the certificate as pks12 but no joy

[CyberDrac]

The gentleman in our establishment who is attempting to implement this would greatly appreciate further details/scripts etcetera as it sounds like you have moved on the extra steps that we're attempting to implement.

[slancaster]

Certificate Install to System Keychain - Smoothwall SSL

 

*export guardian cert.crt from smoothwall*

 

first copy your guardian cert (.crt) to the root drive of each mac with ard

 

then use this command from ard which adds the file to the local SYSTEM keychain (run as root) replace “certname” with the name of your cert.

 

certtool i /CERTNAME.crt k=/Library/Keychains/System.keychain

 

At this point the cert is installed, but not trusted on your test mac.

Login locally to the mac (you only have to do this on the “test” mac) open Keychain, find the certificate in system certs and “trust all” for the cert.

 

You now need to make a copy of the local trust settings file. This file is located /Library/Security/Trust Settings/Admin.plist

Put this file somewhere easy to access for yourself.

 

Copy this file to each mac with ard inheriting permissions to the same location, reboot all mac's and trust settings are now applied.

 

You should now have 1 mac with the trusted certificate on.

 

Now to batch this process across multiple macs you need to do the first step of copying the cert locally, then run the terminal command to add the certificate and then copy the Admin.plist file to the SAME DIRECTORY on any mac you wish to use this cert with.

I use apple remote desktop to send the files and run the scripts. Takes no time whatsoever once your files are prepped.

One extra step which helps speed things up in a school environment (and also allows youtube iFrames to pull through on google sites etc) is to go in to smoothwall and set the HTTPS Interception warning frequency to “never” rather than weekly etc.

 

For the future however, we are going to install this certificate on the base image for our Macs or at least add the script to the end of our deploy studio workflow.

 

Hope that helps and makes sense!

[CyberDrac]

Thank you, I've passed on the details and I'll advise on any screams of anguish that might be forthcoming from the other end of the room.

[slancaster]

haha no probs! Sounds like we are im similar boats.

Im in the process of migrating from Workgroup Manager to Profile Manger so I may be on here looking for, and posting more fixes.