Deploying the APPLEBEE-ROOT26 root across a Windows domain
================================================================

Running install-root.ps1 per machine is fine for a handful of hosts. Beyond
that, push it centrally.

Group Policy
  1. On a domain controller, open Group Policy Management and edit a GPO
     linked to the OU you want (or the domain root).
  2. Computer Configuration → Policies → Windows Settings → Security Settings
     → Public Key Policies → Trusted Root Certification Authorities.
  3. Right-click → Import, and select applebee-root26-roots.pem (or the individual
     .crt files under certs/).
  4. Machines apply it at next Group Policy refresh, or immediately with
     `gpupdate /force`.

Intune / Microsoft Endpoint Manager
  1. Devices → Configuration profiles → Create profile.
  2. Platform: Windows 10 and later. Profile type: Templates → Trusted
     certificate.
  3. Upload the .cer file from certs/ and set the destination store to
     "Computer certificate store - Root".
  4. Assign to a device group.

Verifying
  certutil -store Root | findstr /i "APPLEBEE-ROOT26"

  Or in PowerShell, checking the fingerprint directly:

    ECDSA (P-256)
      b1aa5115d3adbfb821e8ca6a7db14de180640eb4da3586066b13fe76aec1c762
    RSA (legacy compatibility)
      95fb9ab7db52c08b1084fc7756ed30c64dabe4cdc5dcb77847ccd6f7a8cf9d7b

    Get-ChildItem Cert:\LocalMachine\Root |
      Where-Object { $_.Subject -like '*APPLEBEE-ROOT26*' } |
      Select-Object Subject, Thumbprint, NotAfter

  Note that Windows shows a SHA-1 thumbprint in that column, not the SHA-256
  fingerprint used elsewhere here. To compare like for like:

    Get-FileHash -Algorithm SHA256 certs\<file>.der

Firefox
  Firefox uses its own trust store and ignores the Windows one unless told
  otherwise. Either set the enterprise policy
  `Certificates → ImportEnterpriseRoots = true`, or deploy the root through
  the Firefox policies.json.