Installation of the DNSFilter SSL Root certificate is optional. It is utilized to display block page messages when users attempt to visit
https://websites that are blocked in your PolicyPolicy - a unified collection of content filtering categories, security categories, and whitelist/blacklist entries. Without certificate installation, the user will receive an error in their browser when attempting to visit blocked sites. (This is because of how HTTPS operates, and is why SSL certificates are a technical requirement for any filtering provider)
|Without Certificate||With Certificate|
|User tries to visit http://badsite.com||User is prevented and receives block notification.||User is prevented and receives block notification.|
|User tries to visit https://badsite.com||User is prevented and receives browser error.||User is prevented and receives block notification.|
Without the certificate, an SSL error message similar to the one below will be displayed when a user tries to visit a blocked website:
After installing the DNSFilter SSL root certificate, you will be able to receive block pages over https:// domains, such as the one below:
In order to install the SSL root certificate on Windows, first download the DNSFilter Certificate. (If you are a Managed Services Provider, you have a separate certificate file which you can download from the Tools section of the dashboard.)
Assuming that the certificate was downloaded into the current user's Download folder, you can run the following command in an administrative prompt to install it into the certificate store:
certutil -addstore -enterprise -f "Root" "C:\Users\%username%\Downloads\DNSFilter.cer"
The Firefox browser utilizes it's own certificate store by default. The best way to install for Firefox is simply to link it to the Windows Trust Store.
This can be done one of two ways:
- Navigate to
about:configin Firefox and set
- Running the following command in an administrative command prompt. (Credit to Thomas Leister)
ECHO pref("security.enterprise_roots.enabled", true); > "C:\Program Files\Mozilla Firefox\defaults\pref\firefox-windows-truststore.js"
Add-Content "C:\Program Files\Mozilla Firefox\defaults\pref\firefox-windows-truststore.js" "pref('security.enterprise_roots.enabled', true);"
The following PowerShell script will download the certificate to the temp folder, and then install it to the system and enable Firefox to use the system certificate store. This is mostly for MSP's who need to mass deploy the certificate with their RMM tool.
$url = 'https://app.dnsfilter.com/certs/DNSFilter.cer' $File = "C:\Windows\Temp\DNSFilter.cer" (New-Object System.Net.WebClient).DownloadFile($url, $file) & certutil -addstore -enterprise -f "Root" $File Add-Content "C:\Program Files\Mozilla Firefox\defaults\pref\firefox-windows-truststore.js" "pref('security.enterprise_roots.enabled', true);"
SSL Certificates not necessary with Roaming Client
As part of the installation process, the Windows Roaming Client will install our SSL certificate as well as create a link in Firefox. Deploying the SSL certificate is thus only necessary for devices that will not have a Roaming Client.
Organizations that utilize Active Directory can use Group Policy to push the DNSFilter root certificate across their infrastructure. Setup for this takes only a few minutes, and is illustrated in this clip and documented below. (Keep in mind your Group Policy OU may be different)
Managed Services Providers (MSPs) have a different certificate file but the install procedure is the same
The steps to install the DNSFilter SSL certificate on Active Directory are:
- On a domain controller in the forest of the account partner organization, start the Group Policy Management snap-in.
- Find an existing Group Policy Object (GPO) or create a new GPO to contain the certificate settings. Ensure that the GPO is associated with the domain, site, or organizational unit (OU) where the appropriate user and computer accounts reside.
- Right-click the GPO, and then click Edit.
- In the console tree, open Computer Configuration\Policies\Windows Settings\Security Settings\Public Key Policies, right-click Trusted Root Certification Authorities, and then click Import.
- On the Welcome to the Certificate Import Wizard page, click Next.
- On the File to Import page, type the path to the appropriate certificate files (for example, \fs1\c$\fs1.cer), and then click Next.
- On the Certificate Store page, click Place all certificates in the following store, and then click Next.
- On the Completing the Certificate Import Wizard page, verify that the information you provided is accurate, and then click Finish.
- Repeat steps 2 through 6 to add additional certificates for each of the federation servers in the farm.
(this was taken from a relevant Microsoft article)
The SSL certificate can be installed on MacOS via the shell commands listed below. (If you are a Managed Services Provider, you have a separate certificate file which you can download from the Tools section of the dashboard.)
wget -P ~/Downloads https://app.dnsfilter.com/certs/DNSFilter.cer sudo /usr/bin/security add-trusted-cert -d -r trustRoot -p ssl -p basic -k /Library/Keychains/System.keychain ~/Downloads/DNSFilter.cer
In order to install the SSL root certificate, you'll be required to have a passcode on the device.
- Download the certificate file. Tap on the file and there will be a prompt to install the certificate.
- Turn on trust for SSL by navigating to Settings -> General -> About -> Certificate Trust Settings. Under "Enable full trust for root certificates," turn on trust for the certificate. Apple's instructions for this step are here: https://support.apple.com/en-us/HT204477
The instructions provided below are from from Google:
- Open your device's Settings app
- Tap Security & location and then Advanced and then Encryption & credentials.
- Under "Credential storage," tap Install from storage.
- In the top left, tap
- Under "Open from," tap where you saved the certificate.
- Tap the file. (If needed, enter the key store password. Tap OK.)
- Type a name for the certificate.
- Pick VPN and apps or Wi-Fi.
- Tap OK.
This is the final article in the site deployment guide. You are now fully configured to use DNSFilter on your network!
We recommend looking at the Roaming Clients sections if you wish to deploy protection on your roaming/off-site devices. It is also highly encouraged that you view the Preventing Circumvention article, in order to prevent users from bypassing your content filter.
Updated 7 months ago