There are several methods for installing certificates transparently, the most obvious and common of which is undoubtedly a GPO. But a GPO isn’t always the fastest solution (for example: whoever needs to deploy the certificates might not have permissions to work on GPOs, or the certificate might only need to be installed on a handful of PCs, so whoever should create the GPO doesn’t treat it as a priority and the timeline risks stretching out)

So let’s see how to deploy a self-signed CA certificate via KACE 1000. Afterwards, using the same procedure, we’ll also install a second, intermediate certificate on the clients, itself validated by the CA.

• The certutil.exe utility
  • Definitions
  • Importing the CA via certutil.exe
  • Importing the intermediate certificate
• The kscript on Kace
  • Task summary
  • Building it
  • Scheduling

The certutil.exe utility

certutil.exe is a utility, present on every Windows system, that lets us do a lot of things with certificates. We can convert them if the format we have isn’t the one we need, import and export them (both locally and to Active Directory), verify the validity of private/public key pairs, and so on.

It’s used from the command line, and for the full syntax I’ll point you to the dedicated page on the Microsoft Knowledge Base

Definitions

• Both of our certificates are already in .cer format
• The CA certificate is called NGIRootCA01
• The intermediate certificate is called NGISSLCA01.cer

Importing the CA via certutil.exe

The import command, which we can run from any administrative prompt, is the following

start /wait certutil -addstore Root NGIRootCA01.cer

The -addstore parameter defines the datastore where we’ll install the certificate. Root corresponds to “Trusted Root Certification Authorities”

Importing the intermediate certificate

The intermediate certificate (which we’ll call SSLCA01.cer) referenced earlier is imported the same way, only changing the target datastore:

start /wait certutil -addstore CA NGISSLCA01.cer

The kscript on Kace

Now let’s bring all of this over to Kace 1000, by creating a dedicated script.

Task summary

• Setting up the basic parameters
• Importing the two certificates as dependencies
• Creating a batch file
• Scheduling

Building it

1. Go to Scripting / Scripts and create a new kscript (“New”)
2. Once you’ve given it a name, go to the Operating Systems section and click Manage Operating Systems, selecting all the Windows OSs (and, since we’re going to create a batch file, only the Windows ones) you’re interested in
   
3. Verify that Windows Run As is set to Local System
   

4. In the Dependencies section, click +New Dependency… and upload:

   1. The Root certificate
   2. The Intermediate certificate
      

5. Now click +Task… in the section below and set up the following steps:

   1. Verify that the file “C:\Tools\certificato.ok” exists (this will let us check whether the certificate has already been applied — since we’ll schedule this script to run at regular intervals, if the certificato.ok file exists the script stops right there). For reference on why this path was chosen, see this earlier article of mine
   2. On Success: nothing
   3. Remediation: Run the batch file “Install_CA_Root_Script” with params “”
      
      Code:

       @echo off
       start /wait certutil -addstore Root NGIRootCA01.cer
       start /wait certutil -addstore CA NGISSLCA01.cer
       exit
      

   4. On Remediation Success Launch a program…
      
6. Click Save to finish creating the kscript

Scheduling

If we want to schedule the script, once back in editing mode it’s enough to set the desired window. For example, in our case the script will run on the target devices every three hours, following this logic:

1. The script runs for the first time
2. When it finishes, it leaves a “certificato.ok” file, 0 bytes in size, in C:\Tools\
3. From the next run onward (every three hours…) if it finds the “certificato.ok” file, it stops and does nothing else