--- title: Install the CA to avoid certificate errors slug: legacy/install-the-ca-to-avoid-certificate-errors description: Unlock access to HTTPS blocked websites with ease by installing a Certification Authority (CA) on your devices. This guide outlines two methods for installation: manual and via Microsoft Active Directory. docTags: createdAt: 2024-08-05T08:51:20.211Z --- When you try to open an Https blocked website for security policies, a browser certificate warning message appears. To avoid this issue you can install our Certification Authority (CA) on your devices. It's possible to perform a manual installation or a massive deployment under Microsoft Active Directory Server. ## MANUAL INSTALLATION Logon with an administrative account on the device. [ download the Certification Authority](https://cloud.flashstart.com/customerarea/share.php?mode=download\&lang=EN\&code=share_ca_ssl) on the Desktop. Unzip the *WebFilter.zip* file and right-click on the extracted *WebFilter.crt* file. Click \[Install certificate] from the menu. Choose to install the certificate for Local Machine and press \[Next] to continue. ::Image[]{src="https://api.archbee.com/api/optimize/qeNTDI134aDAkmAtZMoNc/gZLOG-M0BxLKT53Ke3AC1_image.png" size="50" width="541" height="527" position="center" caption="Certificate Import Wizard" alt="Certificate Import Wizard" darkWidth="541" darkHeight="527" showCaption="true"} Choose Place all certificates in the following store and then click on the \[Browse...] button. ::Image[]{src="https://api.archbee.com/api/optimize/qeNTDI134aDAkmAtZMoNc/0hf7JFptoZmdw3Pub2MZ-_image.png" size="50" width="539" height="527" position="center" caption="Place Certificates" alt="Place Certificates in the store" darkWidth="539" darkHeight="527" showCaption="true"} Highlight *Trusted Root Certification Authorities* and then confirm with \[OK]. Finally, click \[Finish] to complete the *CA* installation. **N.B **If it does not work on mozilla firefox, please refer to the [following guide](docId:4zr4bd9689G8rIs-h_Drj). ## INSTALLATION USING ACTIVE DIRECTORY GPO *Certification Authority* using the Group Policy in a Microsoft Active Directory environment. **NOTE:** In the following guide we'll explain how to create the policy with Microsoft Windows Server 2012 but the steps are silimar also with the other versions of Windows. Log into your Active Directory Server, using an administrative account and [download the Certification Authority](https://cloud.flashstart.com/customerarea/share.php?mode=download\&lang=EN\&code=share_ca_ssl) on the Desktop. Unzip the *WebFilter.zip* file and right click on the extracted *WebFilter.crt* file. Open the group policy management console by running *gpmc.msc* command. ::Image[]{src="https://api.archbee.com/api/optimize/qeNTDI134aDAkmAtZMoNc/0MZfD3jO8_FFx9NHGNCrK_image.png" size="50" width="428" height="236" position="center" caption="gpmc.msc" alt="gpmc.msc" darkWidth="428" darkHeight="236" showCaption="true"} Choose your domain, right click and select Create a GPO in this domain and link it here. ::Image[]{src="https://api.archbee.com/api/optimize/qeNTDI134aDAkmAtZMoNc/yLsY43uJIV9078iBVBxBk_image.png" size="50" width="1008" height="492" position="center" caption="GPO" alt="Create a GPO" darkWidth="1008" darkHeight="492" showCaption="true"} Type a name for your GPO and click \[OK] to create it. ::Image[]{src="https://api.archbee.com/api/optimize/qeNTDI134aDAkmAtZMoNc/Cxw0nTsQDP86a6nXCrRtH_image.png" size="50" width="398" height="184" position="center" caption="Signing Certificate" alt="Signing Certificate" darkWidth="398" darkHeight="184" showCaption="true"} Righ click on the policy you've just created and then select \[Edit]. In the new window navigate to Computer Configuration->Policies->Windows Settings->Security Settings->Public Key Policies. ::Image[]{src="https://api.archbee.com/api/optimize/qeNTDI134aDAkmAtZMoNc/nod-6xwZNxoIC1Z2C2joh_image.png" size="50" width="931" height="422" position="center" caption="Public key Policies" alt="Public key Policies" darkWidth="931" darkHeight="422" showCaption="true"} Right click on the Trusted Root Certification Authorities entry and click \[Import]. ::Image[]{src="https://api.archbee.com/api/optimize/qeNTDI134aDAkmAtZMoNc/OGNakkRzs88V7cvdoNQUj_image.png" size="50" width="1041" height="391" position="center" caption="Import Rood" alt="Import Root" darkWidth="1041" darkHeight="391" showCaption="true"} Click \[Next] and then click \[Browse...] to choose our Certification Authority. ::Image[]{src="https://api.archbee.com/api/optimize/qeNTDI134aDAkmAtZMoNc/IB42AcpDlYbREY4o_wOaj_image.png" size="50" width="550" height="526" position="center" caption="Browse" alt="Browse" darkWidth="550" darkHeight="526" showCaption="true"} Select the extracted certificate, called WebFilter.crt, you saved before on your Desktop and click \[Open]. Click \[Next] to proceed. Choose Place all certificates in the following store and then click on the \[Browse...] button. Highlight Trusted Root Certification Authorities and then confirm with \[OK]. Then confirm with \[Next]. Finally, click \[Finish] to complete the procedure. ::Image[]{src="https://api.archbee.com/api/optimize/qeNTDI134aDAkmAtZMoNc/D5f3MPV88j81HmYjkt1Sn_image.png" size="50" width="545" height="525" position="center" caption="Certificate Import Wizard" alt="Certificate Import Wizard" darkWidth="545" darkHeight="525" showCaption="true"} Navigate to Computer configuration->Policies->Administrative Templates Policy definitions->Windows Components->Windows Update. Double click Allow signed content from intranet Microsoft update service location. ::Image[]{src="https://api.archbee.com/api/optimize/qeNTDI134aDAkmAtZMoNc/G5JkRWcnamnarWKqhgikp_image.png" size="50" width="1279" height="524" position="center" caption="Windows Update" alt="Windows Update" darkWidth="1279" darkHeight="524" showCaption="true"} Next select \[Enabled]. Click \[OK] to confirm. ::Image[]{src="https://api.archbee.com/api/optimize/qeNTDI134aDAkmAtZMoNc/2PQJPcG80rmoIA57rkwOj_image.png" size="50" width="705" height="650" position="center" caption="Enabled Microsoft Update" alt="Enabled Microsoft Update Service Location" darkWidth="705" darkHeight="650" showCaption="true"} The new group policy will be updated, on your internal devices, based on the refresh interval time. The standard interval is 90 minutes. **NOTE**: You can use the gpupdate /force command to immediately load the policy on your PC. **Other ways to ask**: - How can I install the Certificate Authority to prevent SSL/TLS certificate errors? - What steps should I take to install the CA and eliminate certificate trust issues?