Distributing the default SonicWall DPI-SSL CA certificate to client computers using Group Policy

03/26/2020 471 22765

DESCRIPTION:

SonicWall Client DPI-SSL feature re-writes the certificate sent by the remote server and signs this newly generated certificate with the certificate specified in the Client DPI-SSL configuration. By default, this is the SonicWall DPI-SSL (CA) certificate. A different certificate can also be specified by importing a signed certificate into the SonicWall. To avoid users from getting certificate trust errors in their browser when visiting a SSL enabled website, the SonicWall DPI-SSL (CA) certificate (or the imported certificate used for re-signing) should be added to the trusted root store of the client machines on the network. In a Windows PKI environment the certificate can be distributed to clients using Group Policy. This article illustrates the method to deploy the Client DPI-SSL re-signing certificate with Group Policy.

NOTE: Some browsers like Firefox do not use the Windows certificate store but have their own certificate store. In such cases, the certificate may have to be manually imported into the browsers' trusted list.

RESOLUTION:

Downloading the Client DPI-SSL Certificate

1. Login to the SonicWall management GUI.
2. Navigate to  Manage | Deep Packet Inspection | SSL Client Deployment page.
3. Click  (download) link to download and save the certificate selected for re-signing..
   
   

Configuring Domain Group Policy 

 NOTE: To perform this procedure, you must be a member of the Domain Admins group or the Enterprise Admins group in Active Directory or you must have been delegated the appropriate authority.

1. Navigate to Start | Administrative Tools and click Group Policy Management.
   
   
   
2. Navigate to Domains | [your domain name].
3. Right click Default Domain Policy and click Edit.
   
   
   
4. In the Group Policy Management Editor window, navigate to Computer Configuration | Policies | Windows Settings | Security Settings | Public Key Policies | Trusted Root Certification Authorities.
5. Right-click on Trusted Root Certification Authorities and select Import.
   
   
   
6. In the Certificate Import Wizard, browse to the location of the file.
7. Select SonicWall_DPI-SSL_CA.cer.
8. Click Next.
9. Click Finish.
   
   
   
10. From the command prompt, enter gpupdate /force to update the Group Policy.
    
11. When a user logs in to the domain these settings will be applied and the certificate will be trusted by any Web Browser that uses the Windows Certificate Store (Internet Explorer, Edge, Chrome).

 TIP: For Mozilla Firefox please see their documentation on how to deploy this at the links below:

• https://wiki.mozilla.org/CA:AddRootToFirefox.
• https://developer.mozilla.org/en-US/Firefox/Enterprise_deployment.

Resolution for SonicOS 6.2 and Below

The below resolution is for customers using SonicOS 6.2 and earlier firmware. For firewalls that are generation 6 and newer we suggest to upgrade to the latest general release of SonicOS 6.5 firmware.

Downloading the Client DPI-SSL Certificate

1. Login to the SonicWall management GUI.
2. Navigate to the DPI-SSL | Client DPI-SSL page.
3. Click  (download) link to download and save the certificate selected for re-signing.

Configuring Domain Group Policy

NOTE: To perform this procedure, you must be a member of the Domain Admins group or the Enterprise Admins group in Active Directory or you must have been delegated the appropriate authority.

1. Navigate to Start | Administrative Tools and click Group Policy Management.
   
   
   
2. Navigate to Domains | [your domain name].
3. Right click Default Domain Policy and click Edit.
   
   
   
4. In the Group Policy Management Editor window, navigate to Computer Configuration | Policies | Windows Settings | Security Settings | Public Key Policies | Trusted Root Certification Authorities.
5. Right-click Trusted Root Certification Authorities and select Import.
   
   
   
6. In the Certificate Import Wizard, browse to the location of the file.
7. Select SonicWall_DPI-SSL_CA.cer.
8. Click Next.
9. Click Finish.
   
   
   
10. From the command prompt, enter gpupdate /force to update the Group Policy.
    
    
11. When a user logs in to the domain these settings will be applied and the certificate will be trusted by any Web Browser that uses the Windows Certificate Store (Internet Explorer, Edge, Chrome).

TIP: For Mozilla Firefox please see their documentation on how to deploy this at the links below:

• https://wiki.mozilla.org/CA:AddRootToFirefox.
• https://developer.mozilla.org/en-US/Firefox/Enterprise_deployment.