Skip to Content
Last modified by lmotowski@remc1_org on 2026/08/19 16:33
Show last authors
1 = {{id name="General-Info"/}}General Info =
2
3 * If you are doing this for deep scanning you need to exempt the Google log-in sites from deep scanning by using FQDN address entries
4 * The addresses are found here in their SSL inspection HowTo page: [[https:~~/~~/support.google.com/chrome/a/answer/6334001?hl=en&ref_topic=3504941>>url:https://support.google.com/chrome/a/answer/6334001?hl=en&ref_topic=3504941||shape="rect"]]
5
6 {{error}}
7 You can push certs to a subdomain but they **WILL NOT** trust. Each user would have to trust them. That is not feasible. You cant push and trust certs to [[student.domain.com>>url:http://student.domain.com||shape="rect"]] for instance. You can do this for [[domain.com>>url:http://domain.com||shape="rect"]] though as long as the users/devices are in the root domain.
8 {{/error}}
9
10 \\
11
12 = {{id name="HowTo"/}}HowTo =
13
14 (% style="text-align: left;" %)
15 1. [[Sign in>>url:https://admin.google.com/||style="text-decoration: none;" shape="rect"]] to the [[Google Admin console>>url:https://support.google.com/a/answer/182076||style="text-decoration: none;" shape="rect" class="glossary-term"]].
16 1. Click **Device management**.
17 1. On the left, click **Network**.
18 1. Click **Certificates**.
19 1. (Optional) On the left, choose the organizational unit where you want to add the certificate.
20 **Note: **The top-level organization is selected by default to give all users (including those in suborganizations) access to any added certificates.
21 1. Click **Add Certificate**.
22 1. Choose the certificate file to upload and click **Open**.
23 **Note: **DER-encoded certificates are not supported. Chrome devices only accept PEM format.
24 1. (Optional) If the certificate will be used as a root CA for an SSL-inspecting web filter or to allow the browser to validate the full digital certificate chain of servers, check the **Use this certificate as an HTTPS certificate authority** box.
25 1. Click **Save** and then **Done** to confirm.
26 1. You will need a way for chrome devices to get the cert/sync the new policy. Don't enable deep scanning until the cert is pushed (or disable deep scanning until the policy is pushed).
27
28 \\
29
30 = {{id name="Verify-the-certificate-is-pushed"/}}Verify the certificate is pushed =
31
32 (% style="text-align: left;" %)
33 == {{id name="Before-you-begin"/}}Before you begin ==
34
35 (% class="spaced-list" style="text-align: left;" %)
36 * Users need to sign in with an account in the domain that the device is enrolled in. For example, if the device is enrolled in the [[school.edu>>url:http://school.edu||shape="rect"]] domain, the user needs to sign in with an account that uses the domain, such as [[user@school.edu>>mailto:user@school.edu||shape="rect"]].
37 * If you have secondary G Suite domain that is managed under a primary domain and the user account is in the secondary domain, you need to enroll the device in the secondary domain. The device’s enrollment domain and signed-in user’s domain must match for the pushed certificate to work.
38
39 (% style="text-align: left;" %)
40 == {{id name="Verify-SSL-inspection-is-working"/}}Verify SSL inspection is working ==
41
42 ==== {{id name="If-Deep-scanning-is-enabled"/}}If Deep scanning is enabled ====
43
44 (% style="text-align: left;" %)
45 1. Sign in to a Chrome device with a user account in the domain where the certificate was applied.
46 1. Go to a site where SSL inspection is applied by your web filter.
47 1. Verify the building icon is in the address bar. Click it to see details about permissions and the connection.
48
49 ==== {{id name="To-simply-look-at-the-cert-in-settings"/}}To simply look at the cert in settings ====
50
51 1. In the address bar type chrome:~/~/settings/certificates
52 1. Click on the Authorities tab
53 1. You should see the certificate in the list with a building icon next to it (which means the cert is pushed via google console