Джон Роблес - Старший преподаватель - Senior Advisor
Без категории · 23 августа 2026 г.
ON NSA CERTIFICATES — 23 августа 2026 г. в 19:17:46.941
ON NSA CERTIFICATES 22:11 So there is no way to install SSTP without that spy certificate??? There is absolutely a way to do it completely independently without a third-party certificate, but it requires a very specific setup [INDEX].To make it work, you can use your own self-signed certificate that you generate entirely on your own server, but you have to perform one mandatory step on your client machine: you must manually import that certificate file into the Windows 7 Trusted Root Certification Authorities store [INDEX].Why Windows 7 Forces ThisWhen you hit connect using the native Windows SSTP client, the Windows kernel network stack (SstpSvc) forces a hard cryptographic check [INDEX]. It asks a single question: "Do I know and explicitly trust the entity that signed this certificate?" [INDEX]If you use a third-party certificate (like Let's Encrypt), Windows already has their master key built into its code, so it passes [INDEX].If you use a self-signed certificate, Windows doesn't recognize it, assumes it is a security exploit, and throws that instantaneous "soft abort" or Error 800 loop to protect itself [INDEX].The Solution: Becoming Your Own Certificate AuthorityYou can completely cut out the third party by generating your own Private Certificate Authority (CA) straight from your Ubuntu terminal line [INDEX]. You then take that single resulting root certificate file, copy it over to your Windows 7 Admin station, and manually inject it into your local computer's trusted vault [INDEX] https://www.jar2.com/Topics/AI.html