Manage root certificate configurations

For administrators, signed up for Chrome Enterprise Core, who manage Chrome policies from the Google Admin console.

As an admin, you can use the Google Admin console to add and manage your organization’s private root certificates in the Chrome Root Store. The Chrome Root Store contains the set of certificates that Chrome browser trusts by default. This helps you to ensure seamless and secure access to internal sites for your users.

Before you begin

Add a configuration

You must be a super admin to add new configurations. For details about the super admin role, see Pre-built administrator roles

Sign in with an administrator account to the Google Admin console.
If you aren’t using an administrator account, you can’t access the Admin console.
Go to Menu Devices > Chrome > Connectors.
(Optional) If you’re configuring Chrome Enterprise connectors settings for the first time, follow the prompts to turn on Chrome Enterprise Connectors.
At the top, click + New provider configuration.
In the Set up a provider panel that opens on the right, find Chrome Root Store.
Click Set up.
Enter the configuration name.
Click Add certificate. Enter configuration details:
1. Name—Enter a name for the certificate.
2. File—Click Upload and select the PEM file you want to add.
3. Type—Specify the type of certificate:
  - Root—The certificate should be trusted.
  - Hint—The certificate can be used during path building but is not inherently trusted unless it chains to a known root.
  - Distrust—The certificate should not be trusted.
4. Constraints—To constrain a certificate's validity to a set of IP blocks or domains, enter DNS names or IP blocks in CIDR notation. One entry per line.
Click Add certificate.
Click Add configuration.

After you add a new configuration, it's listed under Chrome Root Store on the Connectors page. You can see the configurations that you added and the number of organizational units where it’s connected.

Configurations are added for your entire organization. You can use them, as needed, in any organizational unit.

From the Admin console Home page, go to Chrome browserConnectors.
Select a child organizational unit.
For Certificate connectors, under Chrome Root Store, select the configuration that you want to use.
Click Save.

Manage configurations

View or edit a configuration

Sign in with an administrator account to the Google Admin console.
If you aren’t using an administrator account, you can’t access the Admin console.
Go to Menu Devices > Chrome > Connectors.
For the configuration that you want to change, click Details.
To edit configuration details:
1. In the Provider configuration section, click Edit.
2. Update the configuration name.
3. Click Save configuration.
To view configuration details, under Certificates, details for all certificates are listed. 10 certificates are listed per page.

Add a certificate to an existing configuration

Note: 50 is the maximum number of certificates allowed.

Sign in with an administrator account to the Google Admin console.
If you aren’t using an administrator account, you can’t access the Admin console.
Go to Menu Devices > Chrome > Connectors.
On the left, make sure that All browsers & devices is selected.
Find the configuration that you want to add a certificate to.
Click Details.
Under Provider configuration, click Edit.
Click Add certificate and enter details.
Click Add certificate.
Click Save configuration.

Remove configurations

Remove all root certificate configurations

Sign in with an administrator account to the Google Admin console.
If you aren’t using an administrator account, you can’t access the Admin console.
Go to Menu Devices > Chrome > Connectors.
Find the root certificate that you want to remove all configurations for.
On the far right, click Delete all configurations.
Click Delete to confirm.

Remove a specific configuration

Sign in with an administrator account to the Google Admin console.
If you aren’t using an administrator account, you can’t access the Admin console.
Go to Menu Devices > Chrome > Connectors.
Find the root certificate configuration you want to remove.
On the far right, click Delete.
Click Delete to confirm.

Verify the root certificate configuration

On a managed device, browse to chrome://certificate-manager.
On the Local certificates page, you can view admin-installed custom local certificates.

Was this helpful?

How can we improve it?