Skip to main content

Microsoft Windows Setup

Describes Chrome DoH setup on Windows for POC/pilot using doh.surepath.ai/dns-query. Covers Chrome config, root CA, and bypass limits. Not for production; use PAC or SASE.

Overview

Admins should use this traffic redirection method only for trials, pilots, and limited deployments. In most cases, end users can bypass the security and governance that F5 SurePath AI provides with this method. For production deployments, customers should use a redirection method that resists bypass.

Devices accessing GenAI sites through SurePath AI must also install the SurePath AI security certificates. Installing certificates across many devices without automation or an MDM tool is an onerous task.

Prerequisites

  • SurePath AI Root Certificate (available from the organization's SurePath AI Field CTO)

  • DNS over HTTPS (DoH) address (in this document)

  • A web browser that supports DoH. This document uses Google Chrome to demonstrate the configuration.

Procedures

All Operating Systems and Browsers

All operating systems need these files and information.

  1. DoH server URL

    1. https://doh.surepath.ai/dns-query

  2. Configuration validation page

    1. https://ready.surepath.ai

    2. This site also provides downloads of the SurePath AI security certificates for admins who do not already have them.

  3. Download certificates in different formats

    1. https://admin.surepath.ai/config/org-settings?tab=1

Setup Chrome on Windows

  1. In Google Chrome, select Chrome Menu > Settings

  2. From the left navigation bar select Privacy and security > Security

  3. Turn on Use secure DNS with the toggle

3. Select Add custom DNS service provider from the drop down menu

4. Enter the SurePath DoH server address into the field provided

Install the SurePath Security Certificate on Windows

  1. Press Win + r keys to open the Run dialog

  2. Enter certmgr.msc into the window and press Enter

  3. On the left side select Trusted Root Certificate Authorities

  4. Certificates should now be visible on the right

3. Right Click on Certificates

4. Select All Tasks > Import

5. Click Next until the save dialog appears.

6. Setup is complete. Continue to configuration validation.

Note: Closing Chrome may be required before the certificate takes effect.

Configuration Validation

After completing interception with SASE software or a DoH setup, use the following website to confirm that GenAI traffic passes through the SurePath AI system.

  1. Navigate to https://ready.surepath.ai/

  2. This webpage confirms whether the configuration is correct.

Related Articles
Did this answer your question?