All right, let's deploy some trusted certificates using Intune.
Now, to begin,
what we need to do is find our root and any intermediate certificates,
and the best place to do that is from any domain‑joined workstation or server.
You don't actually have to do this directly on a CA.
You can actually just do it, again,
from any domain‑joined workstation or server by typing,
just clicking into the search field here,
and just type certlm.msc,
and this opens up the Local Computer Certificates store.
So we can go into our Trusted Root CA folder, and then we'll find our CA.
So here it is.
And again, in this example, I do have two different CAs.
One's a suite B hierarchy, so this is a separate hierarchy.
It is a whole separate PKI infrastructure.
But this is the one specifically that I'm after.
Now, here's the deal.
You'll see that I have just one certificate for this CA
listed in this Trusted Root CA folder.
You may find that you have multiple certificates with
the same name issued by the same CA.
And it's perfectly normal.
There are a couple of cases that kind of cause that.
The first is that it's not uncommon for administrators to
publish the root CA certificate more than once,
so it's not outside the realm of possibility that
these are just simply duplicates.
So if you see multiple certificates here,
double‑click on one of them, go to Details,
and then scroll down to Thumbprint, and then just have a look at the thumbprint.
If you have multiple CA certificates and they each have the same thumbprint,
then it doesn't matter; it's just duplicates.
However, if they have different thumbprints,
it could very well be that these were CAs that were installed and then
removed and then reinstalled again using the same common name,
in which case they would have a different
certificate and a different thumbprint.
Might be that your CA has had the root or issuing CA certificates renewed.
So in those scenarios you might have duplicates,
and it's vital that we choose the correct one.
So, in that case,
I'm going to show you a different way to export this in kind of a more
positive manner to make sure that we get the right one.
So if you expand the Personal and Certificates store and look
for any certificate that was deployed to this endpoint from
the CA that you're interested in, in this case,
this is from my issuing CA here, I'm going to double‑click on this,
and then I'm going to go to Certification Path,
and then I will highlight the root CA certificate.
And then click View Certificate,
and this is absolutely the certificate that we want.
This would be the active root CA certificate.
Here I'm just going to go to Details and then Copy to File.
Then we'll click Next.
We'll select Base‑64 encoding, choose Next, and we'll give this a file name.
So we'll just put it right here on the Desktop, click Next, Finish, and OK.
So we'll click OK.
And I could actually stay here and grab our issuing CA certificate as well.
So if you have a multi‑tier PKI, then I can just simply highlight my issuing CA,
or intermediate or subordinate CA,
whatever you want to call. We'll click View Certificate,
go to Details, Copy to File, click Next,
Base‑64 encoded, Next, provide a file name, and this is our intermediate
or issuing CA. So we'll click Save, Next, Finish, and OK, and we'll close
out. And at this point now, I've saved these certificates to the root, and
now I'm going to upload them to Intune. So here we are in the Microsoft
Endpoint Manager admin center, or management portal, and I'm going to
select Devices.
I'm going to go scroll down a bit here,
select Configuration profiles, and then I will choose Create profile.
Next, I'm going to select the Platform as Windows 10 and later, and
the Profile type will be Templates, and here I'm looking for a
template called Trusted certificate.
So I'll select that and click Create. The first one I want
to issue is my root certificate, so let's just give that a
name. So we'll choose Next.
And here we're just going to click on the little folder here and
select our file that we saved previously. And the Destination store
is, of course, the Computer certificate store in the Root CA folder,
so the default's fine there, so we'll choose Next. And now we'll
assign it to our groups.
And in this case, I'm going to sign it to my VPN Devices so
that anybody logging in from a VPN device will automatically
trust my CA. So we'll choose Next.
And I'm going to skip the Applicability Rules and choose Next and
then click Create. And then I'm going to repeat the process for the
intermediate or issuing CA certificate.
So click Devices, Configuration profiles, Create profile,
Windows 10 and later, and then Templates, and we'll select
Trusted certificate once again, and this time it's going to
be my Issuing CA Certificate.
Choose Next.
And I'm going to click on the folder again, and this time I'm
going to select my issuing CA certificate.
And this time for the Destination store,
I'm going to choose Computer certificate store ‑ Intermediate.
So we'll choose next.
We're going to add our VPN device group once more. Choose Next, Next,
and Create. And at this point, then as soon as those endpoints that are
in that VPN device group sync, they will receive my root CA certificate and my issuing see a certificate.