Comment by throw0101a
3 years ago
> We have an internal certificate authority for internal domains at my job. We add the root CA certificate to each desktop or server through an endpoint agent that runs on every machine.
One challenge to this is some software doesn't use the operating system's CA chain by default. A lot of browsers use their own internal one and ignore what the OS does (by default).
Chrome, Edge, Safari and (god forbid) IE will use system certificate stores.
Firefox was a challenge. But my understanding is that now, on Windows, it will now import enterprise root certificates from the system store automatically.
https://bugzilla.mozilla.org/show_bug.cgi?id=1265113
https://support.mozilla.org/en-US/kb/how-disable-enterprise-...
On Linux Firefox imports system certificates automatically, but shows a warning that the certificate is not trusted by Mozilla.
It is also troublesome when you have to manage cert loading not just on end devices but ephemeral VMs and containers as well.
The big-co I work for handles this via some tooling that checks for browsers and sees if the cert is installed, or by having the ca page signed regularly and having people self install. "Your site look wierd, likely you are missing the CA". It's not solved solved but it's mostly solved. The browsers that come with the image on the enterprise release cadence all have the cert. The people adding other browsers are usually devs or technically savvy enough to add a CA.