BYOD parent monitoring / filtering software, on network with SSL inspection

[bnew]

Hello,

 

Interested to hear how this situation is handled in your district / school.

 

A number of schools in my area employ SSL inspection on student networks, and to this end require that students in the BYOD program install a certificate that is provided by the school.

 

However, an increasing number of parents are starting to opt for installing what I would term 'parental control / monitoring' software, that typically also attempts SSL inspection and installs its own certificates on the device. Some example products include Covenant Eyes, Qustodio and Net Nanny.

 

What we are finding is that BYOD with this category of software installed simply won't work on our networks when we have SSL inspection enabled (even if our certificate is correctly installed)- any attempt to browse to websites is met with ERR_CONNECTION_CLOSED within the browser. Removing the software immediately resolves the issue.

 

Are there any products in this category of software that we can safely suggest to parents that are designed in such a way so that they will function correctly on our networks, alongside our own SSL inspection?

 

Thanks

[ibpalle]

Disclaimer: Smoothwall parent company have just acquired Quostodio mentioned below.

 

This company: https://www.qustodio.com/en/ - provides parental control software for most devices and have had very good feedback from parents. However, I have not had the chance to test this yet so can't for sure say https inspection will interfere.

[bnew]

Thanks for the reply. I can confirm that Qustodio is one of the products that we've encountered that does not work on networks where existing SSL inspection is employed- it causes machines that it is installed on to have no internet connectivity.

 

Surely this situation is not unique or uncommon though? I would assume that most schools would be employing SSL inspection, and any school that has a BYOD program is bound to encounter devices where the parents have opted to install a product like Qustodio on them.

 

I guess I'm just wondering why there aren't more EDU tech people posting about this type of issue.

[GrumbleDook]

As a parent, I am frustrated at times that I can't have more oversight of the chromebook my daughter uses (not BYOD, but lease) and there are some things I have had to accept are impossible with cocking things up for the school. Separate school/home profiles is the only way to get some of it to work, unfortunately.

[pete]

Functionality similar to a PAC file (qustodio getting out of the way if the device can reliably detect it's at school, otherwise on) would be where I would look.

 

If the school has a webserver with a publicly valid cert (https://qustodio.int.school.org, not https://qustodio.school.internal) that's only reachable on the school network you could use that as the check. Participating (verified) schools publish the record in DNS for integration into Qustodio.