Internet Access TLS inspection FAQ
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit f6761e0 · +9 −1 lines · also on GitHub
⋯ 29 unchanged lines
3030
- Define a TLS policy: Configure a TLS inspection policy that aligns with your organization's security and operational requirements.
3131
- Configure Conditional Access: Create a Conditional Access policy and associate it with the Global Secure Access security profile linked to the TLS policy.
3232
- Distribute the trusted certificate: Ensure the selected certificate authority is installed on all client devices to establish trust and enable seamless TLS inspection.
33
−
33
+
34
+ - question: How do I Sign CSR Using the Active Directory Certificate Services (AD CS)
35
+ answer: |
36
+ TLS inspection requires an intermediate certificate authority, ensure you are using the Subordinate CA template. To sign CSR generated from TLS settings,
37
+ you may use AD CS web enrollment UI or use the certreq command-line tool.
38
+ ```cmd
39
+ certreq -submit -attrib "CertificateTemplate:SubCA" "C:\pathtoyourCSR\tlsca.csr" "tlsca.cer"
40
+ ```
41
+
3442
- question: Why do I receive the error "SSL certificate problem unable to get local issuer certificate" when using Git?
3543
answer: |
3644
This error occurs because certain developer tools (such as Git) don't use the operating system's certificate store by default; instead, they maintain their own certificate store.
⋯ 53 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 00:08 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.