This chapter addresses how to install a root certificate automatically or manually. Root certificates improve traffic decryption behavior to both private and internet reources for specific browser types.
Secure access root certificates enhance security and connectivity by enabling traffic decryption for threat detection to private and internet resources. SSE root certificate establishes trust for SAML authentication with identity providers. They also support user and device authentication in VPN connections, ensuring secure remote access. For detailed instructions, see Manage the Secure Access Root Certificate
Automatic or Manual Installation
Certificate installation can be done on a per-browser or per-machine basis. For larger deployments, you can perform an automatic installation through Group Policy Objects (GPO). Note that the automatic installation through GPO is only supported for the Edge or Chrome browsers on Windows systems. As such, for Firefox or Safari browsers, and for users on non-Windows operating systems, you must perform the manual installation procedure.
You can also install a certificate automatically—through Active Directory Group Policy Objects—for a group of users in Microsoft Windows Active Directory. This automatic installation of a certificate is only supported for Edge or Chrome browsers on Windows systems. For all other browsers and systems, you must perform the manual installation procedure.
Push the Cisco Root Certificate to Managed Devices
To support the display of block pages for HTTPS sites, HTTPS decryption if the Intelligent Proxy is used, and Trusted Network Detection if a VA is present, you must push the Secure Access certificate to managed devices