SurePath AI Proxy Integration for Windows via Rippling
This document describes how to configure Rippling to distribute the SurePath AI proxy PAC URL and root CA certificate to Windows devices. These two configurations are covered in the sections below. The configuration needed for MacOS is considerably different and is located in this document.
Supported platforms
Windows 10 1809 and later (including Windows 11)
About this document
This document covers creating the required policy that distributes the proxy configuration and the root CA certificate. It does not include steps on any other parts of the Rippling platform or cover how to enroll devices in Rippling.
The SurePath AI PAC file
SurePath AI distributes its proxy information via a Proxy Auto-Config (PAC) file. This PAC file contains all the information needed to direct only generative AI traffic to the SurePath AI proxy service while sending other traffic via their normal route.
The use of a PAC file also allows SurePath AI to update the list of generative AI domains. Most operating systems and browsers will request the PAC file every 1-2 hours and if a new file can’t be retrieved the current one will continue to be used.
The SurePath AI root CA certificate
Just like other network security and SASE vendors, certificate trust allows SurePath AI to intercept and apply policy to connections to generative AI website. The SurePath AI root CA certificate needs to be trusted by all devices that need to be governed by SurePath AI.
Configure Rippling for Windows devices
All configuration in this section takes place within the Rippling admin dashboard located at https://app.rippling.com/dashboard and unless otherwise stated, all instructions start from this URL. You must ensure you are using an Admin account and not your Employee account. This can be verified by clicking on the user avatar in the upper-right-most area of the dashboard.
Important note
Rippling does not support native Windows configurations or GPO for Proxy PAC URL distribution or root certificate distribution. Because of this, a single PowerShell script is used to configure Windows endpoints with both the SurePath AI Proxy PAC URL and SurePath AI root CA certificate. Since this is deployed with a script, SurePath AI also provides a removal script which removes all configurations from the installation script.
Prerequisites
Currently, your SurePath AI account team will need to provide you the configuration scripts to be used with Rippling. Shortly, these scripts will be available via download via https://admin.surepath.ai.
Creating the Rippling Script configuration for deploying the SurePath AI configuration
In the left menu bar, navigate to IT > Devices
Click the Scripts tab at the top
Click the Add Script
On Add Script modal, enter the following configuration values:
Enter a Script Name, such as SurePath AI Configuration
For Target Platform, select Windows Machines Only
Select Device under the Select menu
Add the devices that will be receiving this configuration
For Frequency of execution, select One-time
It is recommended to check Run on newly enrolled devices meeting the group definition to deploy the configuration to new Windows devices that get added to the Rippling inventory after deploying the script
It is recommended to check Run the script now to deploy the configuration to all Windows devices in the Rippling inventory
Click Submit
Verifying the SurePath AI integration
SurePath AI provides a tool for verifying that an endpoint is configured to properly integrate with SurePath AI's platform. After completing the steps above and verifying the configuration has been deployed to the desired devices administrators can verify the integration by visiting https://ready.surepath.ai.
Interpreting results
A test will be run as soon as the page is loaded. If both tests show green Valid results, the endpoint is properly integrated and GenAI traffic originating from that endpoint will be processed by SurePath AI.
If the Certificate Trust test shows a red Invalid result, it means that the SurePath AI root certificate is not trusted by the device or browser. This could be the result of certificate not being deployed to the device yet. Please check the device's local certificate trust store for the SurePath AI Root CA certificate. If the certificate has been deployed (and/or verified installed), it's possible the device might need to be restarted for the browser to read the newly added SurePath AI root CA certificate.
If the Network Configuration test shows a red Invalid result, it means that the SurePath AI platform is not receiving traffic from the endpoint. This is most likely due to the network configuration not being pushed to the device. Some browsers or applications, like Firefox, ignore system-level proxy settings and have internal proxy settings that will need to be configured separately from the system-level settings that are configured in this document.
Please reach out to your SurePath AI account team if you have any questions or issues with the SurePath AI integration.