SYMPTOMS

Consider the following scenario. You configured Software Restriction Policies (SRP) to allow run all applications that are signed by the specific signer by creating a Certificate Rule against the signer certificate.

When the policy is refreshed on the client, user cannot run the application, because it is blocked by Software Restriction Policies.

CAUSE

This behavior occurs when the certificate is issued by a Certification Authority (CA) which do not include or provide incorrect issuer information in the Authority Information Access (AIA) extension in the signing certificate. In addition, intermediate CA certificate is not installed in the local store. SRP reads only signing certificate in the digital signature and ignores the rest certificates.

This issue may occur when the signing certificate was issued by Thawte due to their CA certificate distribution policy.

STATUS

This behavior is by design. No bug fixes are available. See Workaround section for example steps to overcome the issue.

WORKAROUND

Perform the following steps to install intermediate CA certificate to local certificate store.

Option 1 is a general guidance for intermediate CA certificate retrieval. Option 2 is used only for signing certificates issued by Thawte.

Option 1

Option 2

The following steps can be used to save Thawte Code Signing CA – G2 certificate to a file:

1. Run Notepad;
2. Copy the following text and paste it to Notepad:

   -----BEGIN CERTIFICATE----- 
   MIIEnDCCA4SgAwIBAgIQR5dNeHOlvKsNL7NwGS/OXjANBgkqhkiG9w0BAQUFADCB 
   qTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDHRoYXd0ZSwgSW5jLjEoMCYGA1UECxMf 
   Q2VydGlmaWNhdGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjE4MDYGA1UECxMvKGMpIDIw 
   MDYgdGhhd3RlLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxHzAdBgNV 
   BAMTFnRoYXd0ZSBQcmltYXJ5IFJvb3QgQ0EwHhcNMTAwMjA4MDAwMDAwWhcNMjAw 
   MjA3MjM1OTU5WjBKMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMVGhhd3RlLCBJbmMu 
   MSQwIgYDVQQDExtUaGF3dGUgQ29kZSBTaWduaW5nIENBIC0gRzIwggEiMA0GCSqG 
   SIb3DQEBAQUAA4IBDwAwggEKAoIBAQC3i891W58l2n45sJPbONOpI9CC+ukkflwL 
   joP45npZ5qPFmKeZ0kT/AKalOQSK2imI6tui8xyZFSbCsfT84QxHqQkRBgogkrnH 
   oASMXJQZq1slLB1ifnANzmFs3SuCyc5dSF/3wr68QSMeTyld10+89MUq/GPmfCZO 
   mad5QZ4QSnp5ycaG94aV0ibOPBgq1nzOr82tu/eCLHAmN0XlD0cixgEovS6DXGqk 
   R8Hn0NhrgUY/IRf1B8VDWqZnLLh7YBG1g+71dApycUQ9WP7oGqs4w1nbf244fXbH 
   cmmYNpZX02Yc0lSRBC5UGbDcPbUiXobVKn4g313merFl/sUCTjEtAgMBAAGjggEc 
   MIIBGDASBgNVHRMBAf8ECDAGAQH/AgEAMDQGA1UdHwQtMCswKaAnoCWGI2h0dHA6 
   Ly9jcmwudGhhd3RlLmNvbS9UaGF3dGVQQ0EuY3JsMA4GA1UdDwEB/wQEAwIBBjAy 
   BggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly9vY3NwLnRoYXd0ZS5j 
   b20wHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMDMCkGA1UdEQQiMCCkHjAc 
   MRowGAYDVQQDExFWZXJpU2lnbk1QS0ktMi0xMDAdBgNVHQ4EFgQU1A1lP3q9NMb+ 
   R+dMDcC98t4Vq3EwHwYDVR0jBBgwFoAUe1tFz6/Oy3r9MZIaarbzRutXSFAwDQYJ 
   KoZIhvcNAQEFBQADggEBAFb+U1zhx568p+1+U21qFEtRjEBegF+qpOgv7zjIBMnK 
   Ps/fOlhOsNS2Y8UpV/oCBZpFTWjbKhvUND2fAMNay5VJpW7hsMX8QU1BSm/Td8jX 
   OI3kGd4Y8x8VZYNtRQxT+QqaLqVdv28ygRiSGWpVAK1jHFIGflXZKWiuSnwYmnmI 
   ayMj2Cc4KimHdsr7x7ZiIx/telZM3ZwyW/U9DEYYlTsqI2iDZEHZAG0PGSQVaHK9 
   xXFnbqxM25DrUaUaYgfQvmoARzxyL+xPYT5zhc5aCre6wBwTdeMiOSjdbR0JRp1P 
   uuhAgZHGpM6UchsBzypuFWeVia59t7fN+Qo9dbZrPCU= 
   -----END CERTIFICATE-----

3. Click File menu and click Save or Save As...;
4. In the Save dialog, select the path and file name. Append “.cer” extension to the end of the file name;
5. In the Save as type drop-down list, select All Files (*.*);
6. Make sure that Encoding drop-down list is set to ANSI:
   
7. Click Save button to save the file.

CA certificate installation instructions:

There are three options to install CA certificate to local certificate store:

• Option 1 installs CA certificate to local machine only;
• Option 2 installs CA certificate to a set of computers depending on Group Policy object scope in Active Directory;
• Option 3 installs CA certificate to all machines in the current Active Directory forest

Option 1

1. Log on to target computer with local Administrator permissions;
2. Run Command Prompt in elevated mode;
3. In the Command Prompt, type the following command:
   
   certutil -f –addstore CA path\cacertfile.cer
   
   change “path\cacert.cer” part with actual path and file name.
4. Close Command Prompt.

Option 2

1. Log on to a computer where Group Policy management tools are installed with Domain Admins permissions;
2. Run Group Policy Management console (gpmc.msc);
3. Edit existing or create a new Group Policy Object (GPO).
4. In the GPO editor, expand Computer Configuration\Policies\Windows Settings\Security Settings\Public Key Infrastructure.
5. Under Public Key Infrastructure node right-click on Intermediate Certification Authorities and click Import;
6. Follow Certificate Import Wizard instructions to import CA certificate;
7. Close GPO editor and Group Policy Management console.

When completed, refresh the group policy on the target clients by running “gpupdate /force” command.

Option 3

1. Log on to any Active Directory member with Enterprise Administrator permissions;
2. Run Command Prompt in elevated mode;
3. In the Command Prompt, type the following command:
   
   certutil –dspublish –f path\cacertfile.cer SubCA
   
   change “path\cacert.cer” part with actual path and file name.
4. Close command Prompt.

When completed, refresh the group policy on the target clients by running “gpupdate /force” command.

Option 3 requires that Autoenrollment policy is enabled on clients.

APPLIES TO

• Windows XP Professional
• Windows Server 2003 (all editions)
• Windows Vista Business, Ultimate, Enterprise
• Windows Server 2008 (all editions)
• Windows 7 Professional, Ultimate, Enterprise
• Windows Server 2008 R2 (all editions)
• Windows 8 Professional, Enterprise
• Windows Server 2012 (all editions)
• Windows 8.1 Professional, Enterprise
• Windows Server 2012 R2 (all editions)