- Connect a Windows endpoint to the Internet and run Windows Update to get the latest CRL and Root Certificate Authorities.
- Export the VerisignRoot.cer and DigicertRoot.cer from the Internet accessible Windows endpoint. (Optionally, export SymantecIntermediate.cer and DigicertTimeStamping.cer, however they are included in the CB upgrade.exe binary.)
a. In the search bar, type '
certmgr' or '
certlm.msc' b. On the left, select
Trusted Root Certification Authorities > Certificates c. Right click "
DigicertRoot Assured ID Root CA" d. Select
All Tasks > Export e. If the Wizard pops up hit Next, Select "
DER encoded binary X.509 (.CER)"
f. Name the file
DigicertRoot.cer, and
Finish.
g. Repeat steps A-E for the "
VeriSign Class 3 Public Primary Certification Authority - G5" naming the file
VerisignRoot.cer. h. Optionally, export
- "Symantec Class 3 SHA256 Code Signing CA" (name the file SymantecIntermediate.cer) and
- "DigiCert SHA2 Assured ID Timestamping CA" (name the file DigicertTimeStamping.cer).
3. Copy the
DigicertRoot.cer and
VerisignRoot.cer files to the gapped environment for deployment to Windows endpoints.
4. Deploy the certs remotely to gapped endpoints. The commands can be used to deployed via MDM solution.
a. Open an admin-level command prompt.
b. Change to the directory containing the certificates.
c. Add the VeriSign root certificate to "
Trusted Root Certificate Authorities"
certutil -addstore -f ROOT VerisignRoot.cer
d. Add the Digicert root certificate to "
Trusted Root Certificate Authorities"
certutil -addstore -f ROOT DigicertRoot.cer
e. Optionallly, add the two other intermediate certificates (which are included in the upgrade.exe).
certutil -addstore CA SymantecIntermediate.cer
certutil -addstore CA DigicertTimeStamping.cer