topic Re: [Action Required] Review hostname exemptions requirements for TLS inspection for ChromeOS starti in Peer-Peer Topics

[Action Required] Review hostname exemptions requirements for TLS inspection for ChromeOS starting F

panderson — Thu, 18 Jan 2024 14:23:29 GMT

Can anyone tell me more about this email (assuming others have gotten it)? I am not sure what exactly it is for or what we have to do. Do we need to add the addresses to our filter exclusion list so they bypass filtering? The link brings you to a page that has a bunch of steps, adding certificates to devices, etc. Does anyone have more information on this? reading through everything I think I am beginning to understand it, but right now I feel like I know just enough to be dangerous 🙄

Re: [Action Required] Review hostname exemptions requirements for TLS inspection for ChromeOS starti

Bill_Gibson — Thu, 18 Jan 2024 14:45:48 GMT

Link: https://support.google.com/chrome/a/answer/6334001
E-Mail:

Dear EDU Administrator,

We are writing to let you know that starting February 2024, managed users may be unable to log-in to ChromeOS within your network following an upgrade to our sign-in infrastructure, unless you allowlist relevant hostnames.

What does this mean for your organization?

For users to work on ChromeOS devices in an enterprise network environment that utilizes TLS inspection (also known as SSL inspection), some hostnames need to be exempt from inspection, as explained in this support article.

What do you need to do?

Review and confirm that www.gstatic.com and ssl.gstatic.com are allowed in your enterprise network and exempt from TLS inspection. If these hostnames are not allowlisted, users may be unable to sign-in to their Chromebooks when connected to your enterprise network.

On February 16, 2024, the Google Team will begin an infrastructure migration that would require these hostnames.

Thanks for choosing Google for Education.

– The Google Chrome Team

Re: [Action Required] Review hostname exemptions requirements for TLS inspection for ChromeOS starti

Kim_Nilsson — Thu, 18 Jan 2024 14:48:41 GMT

Talk to your network admin.

If your firewall does TLS Inspection, then you need to exclude ALL Google's addresses listed in the support article.

https://support.google.com/chrome/a/answer/6334001

Re: [Action Required] Review hostname exemptions requirements for TLS inspection for ChromeOS starti

Kim_Nilsson — Thu, 18 Jan 2024 14:49:28 GMT

So, the solution is to NOT do TLS Inspection of the hosts listed in the article.

Re: [Action Required] Review hostname exemptions requirements for TLS inspection for ChromeOS starti

panderson — Thu, 18 Jan 2024 15:06:21 GMT

Yea, this is the email that was confusing me.