6. Distribute the CA certificates issued by the Federal Common Policy CA G2

Do I Need to Distribute the Intermediate CA Certificates?

Operating Systems

You might need to distribute the intermediate CA certificates issued by the FCPCA G2, depending upon your enterprise operating systems’ type and configuration.

• Microsoft Windows: Intermediate CA certificate distribution is recommended.
  • Typically, Windows clients are able to dynamically build paths to a trusted root CA certificate through Microsoft’s Certificate Chaining Engine (CCE).
  • Distributing the intermediate CA certificates improves system performance and prioritizes use of the FCPCA G2 over the FCPCA.
  • There are instances where dynamic validation can fail, for example, when firewall rules prevent Microsoft from navigating to a certificate’s Authority Information Access extension Uniform Resource Locator. Email us at fpkirootupdate@gsa.gov with any questions or issues.

• macOS or iOS: Intermediate CA certificate distribution is required.

• Linux or Unix: Intermediate CA certificate distribution is required.

Applications

Many, but not all, software applications leverage the underlying operating system trust store to verify whether a certificate should be trusted.

Collaborate across agency teams to identify applications that rely on custom trust stores to ensure distribution of the intermediate CA certificates issued by the FCPCA G2.

Example applications with custom trust stores that may require intermediate CA certificate installation:

• Java and all Java-based applications (for example, Apache Tomcat)
• Mozilla products (for example, Firefox or Thunderbird)
• OpenSSL-based applications (for example, Apache HTTP Server or Nginx)

Which Certificates Do I Need to Distribute?

Identify which, if any, of the intermediate CA certificates issued by the Federal Common Policy CA are currently being distributed across your agency.

A recommended starting point would be to replicate the existing configuration for CA certificates issued by the Federal Common Policy CA, instead of distributing the new certificates issued by the Federal Common Policy G2.

If you’re not sure which intermediate CA certificates issued by the FCPCA G2 you need to distribute, consider distributing all of them or email us for help at fpkirootupdate@gsa.gov.

How Do I Distribute the Intermediate CA Certificates?

Recommended solutions for distributing intermediate CA certificates are listed below.

Use Microsoft Group Policy Object

1. Navigate to Server Manager.
2. Select Tools.
3. Select Group Policy Management from the drop-down list.
4. Right-click your desired domain(s), and select Create a GPO in this domain, and Link it here.
5. Enter a GPO Name and click OK.
6. Right-click the newly created GPO and click Edit.
7. Navigate to Policies > Windows Settings > Security Settings > Public Key Policies.

8. Right-click Intermediate Certification Authorities, and select Import.

   The Certificate Import Wizard appears

9. Browse to and select the certificates issued by the FCPCA G2 that you want to distribute.
10. Verify that the target Certificate Store presents Intermediate Certification Authorities, and select Next.

11. Select Finish to complete the import.

    A success message appears.

12. Close the Group Policy Management window.
13. Wait for clients to consume the new policy.
14. (Optional) To force client consumption, click Start, type cmd, press Enter, and run the following command:

           gpupdate /force
    

Use Apple Configuration Profile

Create an Apple Configuration Profile

1. As an administrator, download and verify the certificates issued by the FCPCA G2 that you want to distribute.
2. Download and install Configurator 2 from the Apple App Store.
3. Open Configurator 2 and click File > New Profile.
4. On the General tab, enter a unique profile Name (for example, FPKI Intermediate CA Certificate Distribution Profile) and Identifier (for example, FCPCAG2-Intermediate-0001).
5. On the Certificates tab, click Configure.
6. Browse to and select the certificates you want to distribute.
7. (Optional) Add additional agency-specific configurations or customizations.
8. Click File > Save to save your profile to your preferred location.
9. Follow the steps to distribute the profile to macOS and iOS devices across your enterprise.

Note:  The following video shows you how to create an Apple configuration profile.

Use Linux Command Line

The steps to distribute an intermediate CA certificate are the same as the steps to distribute a root CA certificate.

Certificates Issued By the Federal Common Policy CA G2

The following certificates are published in the Federal Common Policy CA G2 certificate’s Subject Information Access extension bundle located at http://repo.fpki.gov/fcpca/caCertsIssuedByfcpcag2.p7c.

• Issued to: Federal Bridge CA G4
• Issued to: U.S. Department of State AD Root CA
• Issued to: US Treasury Root CA
• Issued to: DigiCert Federal SSP Intermediate CA - G5
• Issued to: Symantec SSP Intermediate CA - G4
• Issued to: Entrust Managed Services Root CA
• Issued to: Verizon SSP CA A2
• Issued to: ORC SSP 4
• Issued to: WidePoint ORC SSP CA 5

Issued to: Federal Bridge CA G4

Issued to: U.S. Department of State AD Root CA

Issued to: US Treasury Root CA

Issued to: DigiCert Federal SSP Intermediate CA - G5

Issued to: Symantec SSP Intermediate CA - G4

Issued to: Entrust Managed Services Root CA

Issued to: Verizon SSP CA A2

Issued to: ORC SSP 4

Issued to: WidePoint ORC SSP CA 5

Certificates issued to the Federal Common Policy CA G2

Distrusting the certificate below will prevent workstations from building a path from the Federal Common Policy CA G2, through the Federal Bridge CA G4, to the Federal Common Policy CA or any other root. For more on how to distrust a certificate, click here.

Issued by: Federal Bridge CA G4

Next, migrate to the FCPCA G2.