Google Workspace - HTTPS Inspection Certificate

[fiza]

We have our HTTPS Inspection Certificate installed on our Chromebooks via the Google Admin Console. This works well for when our users log in.

Occasionally we have students and staff come from other schools and they want to log in with their own Google Workspace logins but on our Chromebooks.

We find that the HTTPS Inspection Certificate doesnt get deployed when they log in with their own accounts. On speaking to Google Support it seems that the Certificate deployment is user based even though in the Console you tick to deploy it to Chromebooks.

 

Does anyone know how to get around this issue other than manually installing for every user that comes on site that wants to use our Chromebooks with their own Google Workspace accounts?

[timbo343]

We have our HTTPS Inspection Certificate installed on our Chromebooks via the Google Admin Console. This works well for when our users log in.

Occasionally we have students and staff come from other schools and they want to log in with their own Google Workspace logins but on our Chromebooks.

We find that the HTTPS Inspection Certificate doesnt get deployed when they log in with their own accounts. On speaking to Google Support it seems that the Certificate deployment is user based even though in the Console you tick to deploy it to Chromebooks.

 

Does anyone know how to get around this issue other than manually installing for every user that comes on site that wants to use our Chromebooks with their own Google Workspace accounts?

I've just tested this at home..

 

So the setup is

- chromebook enrolled at secondary school in Secondary school OU.

- Chromebook configured so that anyone can log on to the chromebook

- test user at primary school (google account) logs on to the chromebook

- we have smoothwall cloud and test user from primary has 888 blocked at a google search

- i would say the cert is pushed out to the device via user policy as google have stated.

 

I presume the other schools are no in the same Google Workspace trust / tenancy?

[TwistedHelixis]

On speaking to Google Support it seems that the Certificate deployment is user based even though in the Console you tick to deploy it to Chromebooks.

I was literally reading something on a Google setup page yesterday and it said the network + certs settings were device based.

[Joeloman]

To me it sounds extremely strange that you allow logins to school computers beyond the school's domain.

Now maybe it's different in the UK but in Sweden it's very common with 1:1 and since the school doesn't want the computers in the school overnight (risk of theft of spare parts like HD and memories etc.) the students get to take the computers home.

So that's why Cloud Filter is very common.

 

If you can log in with another account, you can bypass the local web filter with various apps such as VPN and Proxy services.

 

Swedish schools usually have a number of loan computers that students can use if they forgot their computer at home.

These are also usually given out to substitute teachers and sometimes also to visiting students.

You have then created some ready-made users that you hand out after you have written down who received it, so that you still have traceability.

Perhaps something to follow?

Edited February 28, 2024 by Joeloman

[jthompson]

I've just signed into one of our enrolled Chromebooks with a consumer Gmail account and the cert is not there for that account. It therefore looks like Admin > Devices > Networks > Certificates installs per user and not per device.

[PotNoodleTech]

Certificates are device based but the WIFI networks mandated via the admin interface can be either set at the device level or the user level.