Distributing the default SonicWall DPI-SSL CA certificate to client computers using Group Policy
03/26/2020 474 22913
SonicWall Client DPI-SSL feature re-writes the certificate sent by the remote server and signs this newly generated certificate with the certificate specified in the Client DPI-SSL configuration. By default, this is the SonicWall DPI-SSL (CA) certificate. A different certificate can also be specified by importing a signed certificate into the SonicWall. To avoid users from getting certificate trust errors in their browser when visiting a SSL enabled website, the SonicWall DPI-SSL (CA) certificate (or the imported certificate used for re-signing) should be added to the trusted root store of the client machines on the network. In a Windows PKI environment the certificate can be distributed to clients using Group Policy. This article illustrates the method to deploy the Client DPI-SSL re-signing certificate with Group Policy.
NOTE: Some browsers like Firefox do not use the Windows certificate store but have their own certificate store. In such cases, the certificate may have to be manually imported into the browsers' trusted list.
Downloading the Client DPI-SSL Certificate
Login to the SonicWall management GUI.
Navigate to Manage | Deep Packet Inspection |SSL Client Deployment page.
Click (download) link to download and save the certificate selected for re-signing..
Configuring Domain Group Policy
NOTE: To perform this procedure, you must be a member of the Domain Admins group or the Enterprise Admins group in Active Directory or you must have been delegated the appropriate authority.
Navigate to Start | Administrative Tools and click Group Policy Management.
Navigate to Domains | [your domain name].
Right click Default Domain Policy and click Edit.
In the Group Policy Management Editor window, navigate to Computer Configuration | Policies | Windows Settings | Security Settings | Public Key Policies | Trusted Root Certification Authorities.
Right-click on Trusted Root Certification Authorities and select Import.
In the Certificate Import Wizard, browse to the location of the file.
From the command prompt, enter gpupdate /force to update the Group Policy.
When a user logs in to the domain these settings will be applied and the certificate will be trusted by any Web Browser that uses the Windows Certificate Store (Internet Explorer, Edge, Chrome).
TIP: For Mozilla Firefox please see their documentation on how to deploy this at the links below: