SurePath AI Proxy Integration via Google Chrome and ChromeOS
Supported platforms
Proxy PAC URL distribution
Chrome browser on Windows, Mac, Linux, and Android
Chrome browser on iOS is NOT supported
ChromeOS devices such as Chromebooks
Root CA certificate distribution
ChromeOS devices such as Chromebooks
Android and iOS (requires advanced mobile management licensing from Google)
On other platforms such as Windows or macOS, Google Workspace does not control the root certificate store. Another MDM solution would need to be used to distribute the root CA certificate.
About this document
The configurations in this document do not cover how to enroll devices in Google Workspace. It will cover how to create the required policy that distributes the proxy configuration and the root CA certificate.
The SurePath AI PAC file
SurePath AI distributes its proxy information via a Proxy Auto-Config (PAC) file. This PAC file contains all the information needed to direct only generative AI traffic to the SurePath AI proxy service while sending other traffic via their normal route.
The use of a PAC file also allows SurePath AI to update the list of generative AI domains. Most operating systems and browsers will request the PAC file every 1-2 hours and if a new file can’t be retrieved the current one will continue to be used.
The SurePath AI root CA certificate
Just like other network security and SASE vendors, certificate trust allows SurePath AI to intercept and apply policy to connections to generative AI website. The SurePath AI root CA certificate needs to be trusted by all devices that need to be governed by SurePath AI.
Configuring Google Workspace
All configuration in this section takes place within the Google Workspace admin portal located at https://admin.google.com and unless otherwise stated, all instructions start from this URL.
Important note
The proxy PAC URL policy is applied within Google Workspace at the user level, not at the device level. For the policy to apply, it must be applied in the directory structure where the targeted users exist. If multiple Organizational Units (OU) need the policy, simply replicate the policy for the different OUs.
Prerequisites
The proxy PAC URL and certificate needed for these steps can be found at https://admin.surepath.ai in the Configure menu in Organization under the Integrations tab. The Certificate is available in the File Downloads section (download using the CER option) and the proxy PAC URL is available in the Proxy and Provider URLs section.
Creating the Google Workspace policy for proxy PAC URL distribution
Navigate to Devices > Chrome > Settings
Select the Organizational Unit (OU) that the policy will be applied to
Under the default tab, User & browser settings
Click into the Search or add a filter and type "proxy"
Click on the Proxy Mode search result
Change the Configuration drop down to Always use the proxy auto-config specified below
Enter the proxy PAC URL acquired in the prerequisites section above
Click SAVE
Creating the Google Workspace policy for root CA distribution for ChromeOS
Navigate to Devices > Networks
Select the Organizational Unit (OU) that the policy will be applied to
On the right side, under the Certificates section, click UPLOAD CERTIFICATE
In the Add certificate window
Enter a name for the certificate such as "SurePath AI root CA certificate"
Click UPLOAD and select the certificate downloaded in the prerequisites section above
Select the platforms you want to distribute the certificate to, like Chromebook
Click on the ADD
Verifying the SurePath AI integration
SurePath AI provides a tool for verifying that an endpoint is configured to properly integrate with SurePath AI's platform. After completing the steps above and verifying the configuration has been deployed to the desired devices administrators can verify the integration by visiting https://ready.surepath.ai.
Interpreting results
A test will be run as soon as the page is loaded. If both tests show green Valid results, the endpoint is properly integrated and GenAI traffic originating from that endpoint will be processed by SurePath AI.
If the Certificate Trust test shows a red Invalid result, it means that the SurePath AI root certificate is not trusted by the device or browser. This could be the result of certificate not being deployed to the device yet. Please check the device's local certificate trust store for the SurePath AI Root CA certificate. If the certificate has been deployed (and/or verified installed), it's possible the device might need to be restarted for the browser to read the newly added SurePath AI root CA certificate.
If the Network Configuration test shows a red Invalid result, it means that the SurePath AI platform is not receiving traffic from the endpoint. This is most likely due to the network configuration not being pushed to the device. Some browsers or applications, like Firefox, ignore system-level proxy settings and have internal proxy settings that will need to be configured separately from the system-level settings that are configured in this document.