...
Windows workstations in Nexus have had the GlobalSign SHA256 IntranetSSL certificate chain added to their operating system's certificate store. Common browsers which use the OS store (Internet Explorere.g., Chrome, and Firefox, Edge) will therefore automatically trust this chain and users should not need to know the difference. Firefox does not use the OS store on any platform, and therefore unfortunately needs to have the chain added separately. IST is working to add the chain to managed Firefox installations. Unmanaged workstations will need to install the certificate chain manually. The required certificates are available from Globalsign's page. Installation is usually simply a matter of downloading the required certificates and double-clicking them. IST currently only issues SHA256 certificates, so only the "Non-Public SHA256 Chain" should be required. In Windows, click on the "Download (Binary/DER Encoded)" button for each certificate and then right click and choose install on each downloaded file. On a Mac client, you will need to open Keychain Manager and explicitly trust each of the two certificates.
...