DESCRIPTION: 

SonicWall Client DPI-SSL feature re-writes the certificate sent by the remote server and signs this newly generated certificate with the certificate specified in the Client DPI-SSL configuration. By default, this is the SonicWall DPI-SSL (CA) certificate.  A different certificate can also be specified by importing a signed certificate into the SonicWall. To avoid users from getting certificate trust errors in their browser when visiting a SSL enabled website, the SonicWall DPI-SSL (CA) certificate (or the imported certificate used for re-signing) should be added to the trusted root store of the client machines on the network. In a Windows PKI environment the certificate can be distributed to clients using Group Policy. This article illustrates the method to deploy the Client DPI-SSL re-signing certificate with Group Policy

Note:

  • Some browsers like Firefox do not use the Windows certificate store but have their own certificate store. In such cases, the certificate may have to be manually imported into the browsers' trusted list.

RESOLUTION: 

Downloading the Client DPI-SSL Certificate

Login to the SonicWall management GUI
Navigate to the DPI-SSL | Client DPI-SSL page.
Click on the (download) link to download and save the certificate selected for re-signing.

Image

Configuring Domain Group Policy 

To perform this procedure, you must be a member of the Domain Admins group or the Enterprise Admins group in Active Directory or you must have been delegated the appropriate authority.

Click on Start | Administrative Tools and click Group Policy Management.

Image

  • Navigate to Domains | [your domain name]
  • Right click on Default Domain Policy and click on Edit

    Image
  • In the Group Policy Management Editor window, navigate to Computer Configuration | Policies | Windows Settings | Security Settings | Public Key Policies | Trusted Root Certification Authorities
  • Right-click on Trusted Root Certification Authorities and select Import.


Image

  • In the Certificate Import Wizard, browse to the location of the file.
  • Select SonicWall_DPI-SSL_CA.cer.
  • Click Next.
  • Click Finish.

Image

Image

  • From the command prompt, enter gpupdate /force to update the Group Policy

    Image

When a user logs in to the domain these settings will be applied and the certificate will be trusted by any Web Browser that uses the Windows Certificate Store (Internet Explorer, Edge, Chrom)\

 

For Mozilla firefox please see their documentation on how to deploy this at the links below:

https://wiki.mozilla.org/CA:AddRootToFirefox

https://developer.mozilla.org/en-US/Firefox/Enterprise_deployment

RESOLUTION FOR SONICOS 6.5 AND LATER

SonicOS 6.5 was released September 2017. This release includes significant user interface changes and many new features that are different from the SonicOS 6.2 and earlier firmware. The below resolution is for customers using SonicOS 6.5 and later firmware.

Downloading the Client DPI-SSL Certificate

Login to the SonicWall management GUI
Navigate to the Manage | Deep Packet Inspection | SSL Client Deployment page.
Click on the (download) link to download and save the certificate selected for re-signing.

Image

Configuring Domain Group Policy 

To perform this procedure, you must be a member of the Domain Admins group or the Enterprise Admins group in Active Directory or you must have been delegated the appropriate authority.

Click on Start | Administrative Tools and click Group Policy Management.

Image

  • Navigate to Domains | [your domain name]
  • Right click on Default Domain Policy and click on Edit

    Image
  • In the Group Policy Management Editor window, navigate to Computer Configuration | Policies | Windows Settings | Security Settings | Public Key Policies | Trusted Root Certification Authorities
  • Right-click on Trusted Root Certification Authorities and select Import.


Image

  • In the Certificate Import Wizard, browse to the location of the file.
  • Select SonicWall_DPI-SSL_CA.cer.
  • Click Next.
  • Click Finish.

Image

Image

  • From the command prompt, enter gpupdate /force to update the Group Policy

    Image

When a user logs in to the domain these settings will be applied and the certificate will be trusted by any Web Browser that uses the Windows Certificate Store (Internet Explorer, Edge, Chrome)

Referenced from URL:  https://www.sonicwall.com/support/knowledge-base/170504631710382/