Wiki source code of Push Certificate Authority Via Google Chrome Management
Last modified by lmotowski@remc1_org on 2026/08/19 16:33
Hide last authors
| author | version | line-number | content |
|---|---|---|---|
| |
1.1 | 1 | = {{id name="General-Info"/}}General Info = |
| 2 | |||
| 3 | * If you are doing this for deep scanning you need to exempt the Google log-in sites from deep scanning by using FQDN address entries | ||
 |
3.1 | 4 | * The addresses are found here in their SSL inspection HowTo page: [[https:~~/~~/support.google.com/chrome/a/answer/6334001?hl=en&ref_topic=3504941>>url:https://support.google.com/chrome/a/answer/6334001?hl=en&ref_topic=3504941||shape="rect"]] |
| |
1.1 | 5 | |
| |
3.1 | 6 | {{error}} |
| 7 | You can push certs to a subdomain but they **WILL NOT** trust. Each user would have to trust them. That is not feasible. You cant push and trust certs to [[student.domain.com>>url:http://student.domain.com||shape="rect"]] for instance. You can do this for [[domain.com>>url:http://domain.com||shape="rect"]] though as long as the users/devices are in the root domain. | ||
| 8 | {{/error}} | ||
| |
1.1 | 9 | |
| |
3.1 | 10 | \\ |
| 11 | |||
| 12 | = {{id name="HowTo"/}}HowTo = | ||
| 13 | |||
| |
1.1 | 14 | (% style="text-align: left;" %) |
| 15 | 1. [[Sign in>>url:https://admin.google.com/||style="text-decoration: none;" shape="rect"]] to the [[Google Admin console>>url:https://support.google.com/a/answer/182076||style="text-decoration: none;" shape="rect" class="glossary-term"]]. | ||
| 16 | 1. Click **Device management**. | ||
| 17 | 1. On the left, click **Network**. | ||
| 18 | 1. Click **Certificates**. | ||
| 19 | 1. (Optional) On the left, choose the organizational unit where you want to add the certificate. | ||
| 20 | **Note: **The top-level organization is selected by default to give all users (including those in suborganizations) access to any added certificates. | ||
| 21 | 1. Click **Add Certificate**. | ||
| 22 | 1. Choose the certificate file to upload and click **Open**. | ||
| 23 | **Note: **DER-encoded certificates are not supported. Chrome devices only accept PEM format. | ||
| 24 | 1. (Optional) If the certificate will be used as a root CA for an SSL-inspecting web filter or to allow the browser to validate the full digital certificate chain of servers, check the **Use this certificate as an HTTPS certificate authority** box. | ||
| 25 | 1. Click **Save** and then **Done** to confirm. | ||
| |
3.1 | 26 | 1. You will need a way for chrome devices to get the cert/sync the new policy. Don't enable deep scanning until the cert is pushed (or disable deep scanning until the policy is pushed). |
| |
2.1 | 27 | |
| 28 | \\ | ||
| 29 | |||
| 30 | = {{id name="Verify-the-certificate-is-pushed"/}}Verify the certificate is pushed = | ||
| 31 | |||
| 32 | (% style="text-align: left;" %) | ||
| 33 | == {{id name="Before-you-begin"/}}Before you begin == | ||
| 34 | |||
| 35 | (% class="spaced-list" style="text-align: left;" %) | ||
| 36 | * Users need to sign in with an account in the domain that the device is enrolled in. For example, if the device is enrolled in the [[school.edu>>url:http://school.edu||shape="rect"]] domain, the user needs to sign in with an account that uses the domain, such as [[user@school.edu>>mailto:user@school.edu||shape="rect"]]. | ||
| 37 | * If you have secondary G Suite domain that is managed under a primary domain and the user account is in the secondary domain, you need to enroll the device in the secondary domain. The device’s enrollment domain and signed-in user’s domain must match for the pushed certificate to work. | ||
| 38 | |||
| 39 | (% style="text-align: left;" %) | ||
| 40 | == {{id name="Verify-SSL-inspection-is-working"/}}Verify SSL inspection is working == | ||
| 41 | |||
| 42 | ==== {{id name="If-Deep-scanning-is-enabled"/}}If Deep scanning is enabled ==== | ||
| 43 | |||
| 44 | (% style="text-align: left;" %) | ||
| 45 | 1. Sign in to a Chrome device with a user account in the domain where the certificate was applied. | ||
| 46 | 1. Go to a site where SSL inspection is applied by your web filter. | ||
| 47 | 1. Verify the building icon is in the address bar. Click it to see details about permissions and the connection. | ||
| 48 | |||
| 49 | ==== {{id name="To-simply-look-at-the-cert-in-settings"/}}To simply look at the cert in settings ==== | ||
| 50 | |||
| |
3.1 | 51 | 1. In the address bar type chrome:~/~/settings/certificates |
| |
2.1 | 52 | 1. Click on the Authorities tab |
| 53 | 1. You should see the certificate in the list with a building icon next to it (which means the cert is pushed via google console |