Internal certificate authority

SenatorMI Root CA certificate

Some internal services of Senator Meetings & Incentives use certificates issued by our own certificate authority. Computers in the company domain trust it automatically. On other devices (private laptop, Mac, phone, a supplier's computer) install it as described below, otherwise the browser reports that the connection to these services is not secure.

Windows

Into the current user's store, no administrator rights needed. Works for Edge and Chrome.

1. Download SenatorMI-Root-CA.crt and open it.
2. On the Details tab check that the Thumbprint is 9b0aee49b6d9e4602d654f01b54915e3c21f9c87 (the SHA-1 fingerprint above).
3. On the General tab click Install Certificate, choose Current User and Next.
4. Choose Place all certificates in the following store, Browse and select Trusted Root Certification Authorities.
5. Next, Finish and confirm the security warning with Yes.

For all users of the computer choose Local Machine instead of Current User (requires administrator rights).

Mac

1. Download SenatorMI-Root-CA.crt (Windows, Mac, Android button) and open it. The certificate is added to the login keychain.
2. In Keychain Access (find it with Spotlight) open SenatorMI Root CA and check the SHA-256 fingerprint.
3. Expand Trust and set When using this certificate to Always Trust. Confirm the change with your password when closing the window.

Without the third step Safari and Chrome still do not trust the certificates, even with the certificate in the keychain. On a Mac the configuration profile does not enable trust for websites, so it is only meant for iPhone and iPad.

Or in Terminal, including the fingerprint check (for all users, needs an administrator password):

openssl x509 -in ~/Downloads/SenatorMI-Root-CA.crt -noout -fingerprint -sha256
sudo security add-trusted-cert -d -r trustRoot \
  -k /Library/Keychains/System.keychain ~/Downloads/SenatorMI-Root-CA.crt

iPhone and iPad

1. Open this page in Safari, tap iPhone, iPad and allow the profile download.
2. Settings → Profile Downloaded → Install, enter the device passcode and confirm.
3. Settings → General → About → Certificate Trust Settings (at the very bottom) and turn on SenatorMI Root CA.

Without the third step Safari still does not trust the certificates, even with the profile installed.

Android

1. Download SenatorMI-Root-CA.crt.
2. Settings → Security & privacy → More security settings → Encryption & credentials → Install a certificate → CA certificate.
3. Install anyway and select the downloaded file.

Menu names differ between manufacturers; searching Settings for "CA certificate" helps. Installing directly from the browser is not possible.

Linux

Debian, Ubuntu:

openssl x509 -in SenatorMI-Root-CA.pem -noout -fingerprint -sha256
sudo cp SenatorMI-Root-CA.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates

Fedora, RHEL:

sudo cp SenatorMI-Root-CA.pem /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust

Chrome and Chromium on Linux keep their own store: import the certificate in chrome://certificate-manager as a trusted authority.

Firefox

On Windows and Mac, Firefox usually picks up a certificate added to the system by itself. If the page still shows a warning (and always on Linux), import it directly: Settings → Privacy & Security → Certificates → View Certificates → Authorities → Import, select SenatorMI-Root-CA.pem and tick Trust this CA to identify websites.