We are having a custom CA for our local-domains.

The Root CA certificate is installed on all the corporate machines by default, but sometimes it happens that we have someone here who doesn't have it installed.

If the user a) accesses our intranet using http or b) accepts the server-certificate I would like to redirect the user to a site which tells it what happened and how they can install the root CA.

The only solution I found was the following:

<img src="https://the_site/the_image" onerror="redirectToCertPage()">

This is barely a work-around and not really a solution. It can be triggered by other problems then the missing certificate.

Are there any better solutions on how to solve this problem?