Onboard Chromebooks with certificates using Google Workspace, Google Cloud, and SCEP

In this topic, you will learn how to deploy Portnox™ Cloud certificates to Chromebook (ChromeOS) devices using Google Workspace, Google Cloud, and SCEP.

Important:

Before you can deploy Portnox Cloud certificates via Google Workspace, Google Cloud, and SCEP, you must complete the following steps:

Integrate Portnox Cloud and Google Workspace.
Prepare a physical or virtual Windows machine that can access Portnox Cloud SCEP services (has access to the Internet via HTTP), where you will install the Google Cloud Certificate Connector. This machine may run a non-server distribution of the Windows operating system such as Windows 10 or Windows 11, or the Windows Server operating system.
If you plan to use device-based certificates, make sure your Chromebooks are running ChromeOS 138 or later.
Make sure that the Google administrator account that you will use for this configuration has the Shared Device Settings privileges.
Make sure your organization has an active Chrome Enterprise Upgrade (or Chrome Education Upgrade) license.
Have access to a Google Cloud project – either an existing one or a new one you create for this purpose – and administrative (Owner or equivalent) permissions on it. A billing account must be linked to the project; this does not mean you will be charged, but Google requires it to enable APIs. This process generates a small amount of traffic and stays well within Google’s free monthly usage tier even at high volume.

Important:

Google has discontinued the legacy Secure SCEP method for Chromebook certificate enrollment. Some Google Workspace tenants already had it turned off in July 2026, and Google will turn it off for all remaining tenants by the end of 2026. All content in this topic that previously described the legacy method has been removed. If your organization is still using the legacy Secure SCEP method, we strongly recommend that you migrate to the process described in this topic as soon as possible.

Important:

This topic describes a basic configuration process. If your organization already uses Google Cloud for other purposes, or has organization policies, network restrictions, or other non-standard configuration in place, you may need to adjust some of the steps in this topic to fit your environment. Treat this topic as a starting point rather than a configuration that will necessarily work unmodified in every environment.

Note:

If you want to use your own CA instead of the one provided by Portnox, you must either use your own SCEP server to generate supplicant certificates based on your CA, or have your devices obtain certificates in another way. If you use your own SCEP server with your CA, you can follow this topic, but use your own SCEP server URL instead of the Portnox SCEP server URL, and use your own CA certificate instead of the tenant CA certificate. You must also upload your CA certificate in the same section where you can download the Portnox tenant CA certificate. In the configuration profiles, you must still use the same root CA – the CA for the Portnox RADIUS server – because your devices will still use Portnox Cloud RADIUS and must be able to verify its authenticity.

Turn on the Portnox Cloud SCEP services

In this section, you will configure Portnox™ Cloud to provide SCEP services to your devices.

If you have previously turned on the Portnox Cloud SCEP services, skip to the later steps.

Portnox Cloud SCEP services let devices contact the Cloud SCEP server and get a unique certificate for the device or for the specific user of the device.

In the Cloud portal top menu, click on the Settings option.
In the Cloud portal left-hand side menu, click on the Services > GENERAL SETTINGS > SCEP Services option.
Enable integration with SCEP services.
1. Click on the Edit link.
2. Activate the Enable integration checkbox.
3. Click on the Save button.
Click on the ⧉ icon next to the SCEP URL field to copy the SCEP URL, and paste it in a text file for later use.
Click on the ⧉ icon next to the Password field to copy the SCEP password, and paste it in a text file for later use.

Download the root CA certificate from Portnox Cloud

In this section, you will download the Portnox™ Cloud root CA certificate from the Cloud portal and convert it to the Base-64 encoded X.509 format using a Windows computer.

You need the root CA certificate so that your managed devices can verify the validity of Cloud RADIUS servers, which have certificates signed by this root CA certificate. If the root CA certificate is not distributed to managed devices, some devices may show a security warning each time that the user connects to networks managed by Portnox Cloud.

In the Cloud portal top menu, click on the Settings option.
In the Cloud portal left-hand side menu, click on the Services > CLOUD RADIUS SERVICE > Cloud RADIUS instance option.

The right-hand pane shows the list of active servers.
Click on any of the RADIUS instances to show its configuration.
Click on the Download root certificate link to download the root CA certificate.

Save the file on your disk. The default name of the file is rootCertificate.cer.
In Windows, double-click on the downloaded file. In the Open File - Security Warning window, click on the Open button.

The file will be opened in the Windows certificate manager.
In the Certificate window, click on the Details tab and then click on the Copy to File button.
In the Certificate Export Wizard, export the certificate in base-64 encoded format.
1. In the first step of the wizard, click on the Next button.
2. In the second step of the wizard, select the Base-64 encoded X.509 (.CER) option.
3. In the third step of the wizard, select a file to save the exported tenant CA certificate, and click on the Next button.
  For example, save the file as rootCertificate.cer, replacing the file downloaded earlier.
4. In the last step of the wizard, click on the Finish button. Then, close the Certificate window.

Note:

If you use a desktop computer with another operating system, such as macOS or Linux, you can use OpenSSL to convert the certificate to the Base-64 encoded X.509 format:

openssl x509 -inform der -in input_file.cer -outform pem -out output_file.cer

Optional: Hand over information from the Portnox Cloud team to the Google team

In this section, you will learn what information was collected in previous steps from Portnox Cloud, which is needed to configure Google Cloud, the connector, and Google Workspace to work with Portnox Cloud.

If different people are responsible for managing Portnox Cloud and Google Cloud/Google Workspace, here is the information you need to hand over:

The Portnox Cloud SCEP URL. For example, https://scep.portnox.com/b2973887-1274-45a4-91d0-4a342a861c76.
The Portnox Cloud SCEP password.
The root CA certificate file in the Base-64 encoded X.509 format. For example, rootCertificate.cer.

Configure the Google Cloud project

In this section, you will create or select a Google Cloud project, enable the Chrome Management API, create a Pub/Sub topic, and create a service account for the connector.

Open the Google Cloud console.
At the top-left corner of the page, next to the Google Cloud logo, click on the project name to open the Select a resource window. Then, select the project that you want to use for this configuration.

Note:
If you have not yet created a project for this purpose, click on the New project link in the top-right corner of the Select a resource window, give it a descriptive name (for example, chromebook-cert-provisioning), and click on the Create button. Wait a few moments for Google Cloud to finish creating it, then click on the Select Project link.
Open the Chrome Management API page. Then, click on the Enable button.

Note:
The link opens the page for whichever project is currently selected in the Google Cloud console. Check the project name shown at the top of the page and make sure it matches the project you selected in the previous step.

Note:
If this is the first time you are enabling an API in this project, Google Cloud may prompt you to link a billing account before it lets you continue. This does not mean you will be charged – see the note in the prerequisites section at the beginning of this topic.
In the Search for resources, docs, products, and more field at the top of the page, type pub/sub, then click on the Pub/Sub result.

This activates the Pub/Sub API for the project. This process may take a while. A notification at the bottom of the page shows the message: Enabling Cloud Pub/Sub API for this project...
In the left-hand side pane, click on the Topics menu option.
Click on the Create topic button in the top-left corner of the Topics pane.

This opens the Create topic pane.
In the Create topic pane, in the Topic ID field, enter a name for the topic.

In this example, we used the name certificate-provisioning-topic, but you can use any name you like.
In the Create topic pane, make sure that the Add a default subscription checkbox is activated.

Note:
A subscription is required for the connector to be able to read messages from this topic. You can create a non-default subscription later instead, if you prefer.
Click on the Create button at the bottom of the Create topic pane.

This creates the topic and its default subscription, and opens the Topic details pane.
In the info panel on the right-hand side of the page, click on the Permissions tab.

Note:
The info panel is titled with the name of your topic. If the info panel is not visible, click on the Show info panel link in the top-right corner of the page.
Click on the Add principal button.

This opens the Grant access to pane.
In the Grant access to pane, in the New principals field, enter the following account name:
```
cert-provisioning-api-pubsub-publisher@system.gserviceaccount.com
```
Note:
This is a well-known service account belonging to Google’s own back-end infrastructure – not one you create yourself. Google uses it to publish certificate-request messages into your topic.

Warning:
If your organization enforces the Domain Restricted Sharing organization policy, this step will fail, because that policy blocks granting access to principals outside your own domain – including Google’s own service account above. This is not a concern for most organizations, since Domain Restricted Sharing is not enforced by default on a new Google Cloud project. If your organization does enforce it (typically set up deliberately by whoever manages your Google Cloud organization policies), you will need to add an exception for this specific service account before you can complete this step. See Google’s documentation on Domain Restricted Sharing for how to configure exceptions.
In the Select a role field, select the Pub/Sub > Pub/Sub Publisher option.
Click on the Save button.
Open the Service accounts page.
Click on the project name for the project that you are using for Google SCEP onboarding.
In the top-left corner of the Service accounts pane, click on the Create service account button.

This opens the Create service account pane with a three-step wizard.
In the Create service account step of the wizard, in the Service account name field, enter a name for the service account, then click on the Create and continue button.

In this example, we used the name scep-prov-service-account, but you can use any name you like.
In the Permissions (optional) step of the wizard, in the Select a role field, select the Pub/Sub > Pub/Sub Subscriber option.

Note:
Optional: to grant a more granular scope, you can restrict this role to only the specific Pub/Sub topic and subscription you created earlier, using an IAM condition on this service account.
Click on the Continue button.
In the Principals with access (optional) step of the wizard, click on the Done button.
On the Service accounts pane, find the service account that you just created, and copy the value of its Email column into a text file for later use.

In this example, the value is scep-prov-service-account@chromebook-cert-provisioning.iam.gserviceaccount.com.

Install and configure the Google Cloud Certificate Connector

In this section, you will download and install the Google Cloud Certificate Connector on a Windows machine, and configure it to communicate with your Google Cloud project and the Portnox™ Cloud SCEP server.

Note:

We will refer to the Windows machine as the Windows server, but it may run a non-server distribution of Windows. In our example, we used the Windows Server 2025 evaluation edition, but you can also use Windows 10 or Windows 11. What’s important is that this machine runs permanently, because the Google Cloud Certificate Connector is accessed during every certificate request from any Chromebook.

Access the Windows server that you prepared earlier (see the prerequisites) – either directly, if it is a physical machine, or by connecting to it through your virtualization platform, if it is a virtual machine.

In this example, we prepared a Windows Server virtual machine running on an ESXi host, and we access it through the ESXi Host Client.
Download the Google Cloud Certificate Connector, then run the downloaded connector_installer.exe file as an administrator on the Windows server prepared earlier.

Note:
You can do the following steps either on the same Windows server that you prepared earlier or on your desktop computer. However, if you do these steps on your desktop computer, you will need to upload a key file to your Windows server, so we recommend doing this directly on the Windows server instead.
Open the Service accounts page.
Click on the project name for the project that you are using for Google SCEP onboarding.
Click on the name of the service account that you created earlier for the connector.
In the Service account details pane, click on the Keys tab.
Click on the Add key button, then click on the Create new key menu option.

This opens the Create private key window.
In the Create private key window, make sure that the JSON option is selected, then click on the Create button.

This downloads a JSON key file to your computer.
Rename the downloaded file to key.json, then move it to the Google Cloud Certificate Connector installation folder on the Windows server.

Note:
If you did the previous steps on the Windows server, you just need to move the file to the folder. Otherwise, upload the key file from your desktop to the server.

Note:
on Windows Server 2025, the installation folder is C:\Program Files\Google\Google Cloud Certificate Connector but it may be different on different versions of the Windows operating system.
In the Google Cloud Certificate Connector installation folder, create an empty text file named challenge-file.txt, paste the SCEP password that you copied from Portnox Cloud in the first task in this series into it, then save the file.
In the same folder, create a text file named adapter_config.json and populate it with the following content:
```
{
  "adapter_configuration": {
    "request_subscriptions": [
      "projects/your_project_id/subscriptions/your_subscription_id"
    ],
    "key_filename": "key.json"
  },
  "ca_configurations": [
    {
      "type": "SCEP",
      "ca_connection_config_id": "your_ca_connection_config_id",
      "ca_endpoint_url": "your_portnox_scep_url",
      "challenge_filename": "challenge-file.txt"
    }
  ]
}
```
Note:
Replace your_project_id and your_subscription_id with the name of the project in Google Cloud and the name of the Pub/Sub subscription that you created earlier. For example, if you used the project and topic names from the earlier examples in this topic, the full path would be projects/chromebook-cert-provisioning/subscriptions/certificate-provisioning-topic-sub. Replace your_portnox_scep_url with the Portnox Cloud SCEP URL that you copied in the first task in this series.

Important:
The value of your_ca_connection_config_id can be any identifier you choose – it does not come from Google. Make a note of the value you use here, because you will enter the same value in the Certificate Authority connection configuration identifier field when you create the SCEP Certificate Authority connection in Google Admin, in the next task. Both values must match exactly.
For example, if you use the project ID, subscription ID, and Portnox Cloud SCEP URL from earlier in this topic, and choose scep-certificate-provisioning-authority as the CA connection configuration identifier, the file would look similar to this:
```
{
  "adapter_configuration": {
    "request_subscriptions": [
      "projects/chromebook-cert-provisioning/subscriptions/certificate-provisioning-topic-sub"
    ],
    "key_filename": "key.json"
  },
  "ca_configurations": [
    {
      "type": "SCEP",
      "ca_connection_config_id": "scep-certificate-provisioning-authority",
      "ca_endpoint_url": "https://scep.portnox.com/b2973887-1274-45a4-91d0-4a342a861c76",
      "challenge_filename": "challenge-file.txt"
    }
  ]
}
```
Open the Windows Services application, find the GoogleCloudCertificateConnector service, right-click on it, and click on the Start menu option.

Note:
If the service does not start, check that the account running it has permission to log on as a service (Local Security Policy > Local Policies > User Rights Assignment > Log on as a service).

Configure Google Admin

In this section, you will create a SCEP Certificate Authority connection and a certificate provisioning profile in the Google Admin console.

Open the Google Admin console and access the Devices > Networks > Certificates > Certificate Authority connections pane by visiting the following URL: admin.google.com/ac/networks/certificates/ca-connections.
In the Organizational units section, select a specific organizational unit if you want this connection to apply only to the selected organizational unit. Otherwise, leave the default top organizational unit selected.
Click on the ADD CONNECTION button.

This will open the Add Certificate Authority connection screen.
On the Add Certificate Authority connection screen, fill in the connection details as follows:
1. In the Certificate Authority connection type field, select the SCEP Certificate Authority connection radio button.
2. In the Certificate Authority connection name field, enter a name for this connection.
  
  In this example, we used the name scep-cert-auth, but you can use any name you like.
3. In the Service account field, enter the service account email address that you copied earlier in this topic.
  
  In this example, the value is: scep-prov-service-account@chromebook-cert-provisioning.iam.gserviceaccount.com.
4. In the Pub/Sub topic field, enter the full path of the Pub/Sub topic that you created earlier.
  
  Note:
  Use the format projects/your_project_id/topics/your_topic_id. This is the topic itself, not the subscription – do not include /subscriptions/ here.
  
  In this example, using the project and topic names from earlier in this topic, the value is: projects/chromebook-cert-provisioning/topics/certificate-provisioning-topic.
5. In the Certificate Authority connection configuration identifier field, enter the same identifier that you used for your_ca_connection_config_id in the adapter_config.json file earlier in this topic.
  
  Important:
  This value must match the your_ca_connection_config_id value in adapter_config.json exactly, or the connector will not be able to match requests to this connection.
  
  In this example, using the identifier from earlier in this topic, the value would be scep-certificate-provisioning-authority.
6. Click on the ADD button.
Open the Certificate provisioning profiles page.

Alternatively, from the Certificate Authority connections page, click on the Certificates breadcrumb link at the top of the page, then click on the Certificate provisioning profiles tile in the right-hand side pane.
In the Organizational units section, select the organizational unit where you want this profile to apply.

Note:
You can select the same organizational unit as the CA connection, or a child organizational unit.
Click on the ADD PROFILE button.

This opens the Certificate provisioning profile screen.
On the Certificate provisioning profile screen, fill in the profile details as follows:
1. In the Select Certificate Authority connection field, select the connection that you created earlier in this task.
  
  In this example, the name would be scep-cert-auth.
2. In the Platform access section, activate either Enabled for Chromebooks (by user) or Enabled for Chromebooks (by device), depending on how you want to issue certificates.
  
  Note:
  A single certificate provisioning profile can issue either user or device certificates, not both. If you need both user and device certificates, repeat this task to create a second certificate provisioning profile with the other platform access option activated. Both profiles can reference the same Certificate Authority connection.
  
  In this example, we will use user profiles.
3. In the Certificate provisioning profile name field, enter a name for this profile.
  
  In this example, we used the name SCEP Certificate Provisioning, but you can use any name you like.
4. In the Days before expiration to initiate renewal field, enter how many days before expiration a device should request a new certificate.
  
  Note:
  This value is a countdown relative to the certificate’s expiration date, not a fixed date. For example, if the certificate is valid for 365 days (the default in Portnox Cloud’s Certificate expiration (days) setting) and you enter 30 here, the device will request a new certificate 30 days before that 365-day mark – not 30 days after issuance. Make sure this value is smaller than the certificate’s total validity period in Portnox Cloud.
5. In the Authentication type field, select the None option.
6. In the Key usage section, activate both checkboxes: Key encipherment and Signing.
7. In the Subject common name field, enter a variable, or any value you like, for informational and display purposes only.
  For example:
  - ${USER_EMAIL} for user certificates
  - ${DEVICE_DIRECTORY_ID} for device certificates
  Note:
  Portnox Cloud does not use this field to identify the user or device – it uses the SAN UPN field instead, which you will set later in this task. To understand how Portnox Cloud matches certificate identity to your authentication repository, see the following topic: Certificate identity information.
8. Optional: In the following optional fields: Organization, Organizational units, Locality, State, and Country fields, enter information relevant to your organization.
  
  Note:
  These fields are added to the certificate’s subject for informational purposes and are not used by Portnox Cloud to identify devices or users.
9. If you are creating a user certificate profile, in the Subject alternative names section, click on the + icon and add a User Principal entry with the following value:
```
${USER_EMAIL}
```
  Important:
  This entry is required for user certificates. Portnox Cloud uses this field to match the certificate to a user in your authentication repository. If you are creating a device certificate profile instead, skip this step.
10. Click on the + icon again and add a URI entry with the following value:
```
https://googlechromeosdeviceid/${DEVICE_DIRECTORY_ID}
```
  Note:
  The Google Workspace repository does not store device records, only user accounts, so Portnox Cloud cannot match the certificate with a device from the repository like in Entra ID or Active Directory (which store user accounts and device records). For Chromebook device certificates, Portnox Cloud always creates a Portnox account for the device and uses this directory ID for its identifier.
  
  Important:
  This entry is required for device certificates. It is also required for user certificates if you plan to use Google Verified Access – see the optional task later in this topic. Otherwise, for user certificates, it is optional but recommended.
11. Leave the Certificate template name field empty.
  
  Note:
  This field is only relevant if your Certificate Authority is a Microsoft NDES server configured with multiple certificate templates. It does not apply to Portnox Cloud’s SCEP server.
12. In the Encryption key type field, click on the RSA key – 2048bit option.
13. Click on the ADD button.

Optional: Turn on Google Verified Access

In this section, you will enable Google Verified Access to let network services cryptographically verify that connecting Chromebooks are genuine and policy-compliant.

Google Verified Access lets a network service cryptographically confirm that a connecting Chromebook is genuine, enrolled, and running an unmodified, policy-compliant version of ChromeOS. Setting it up involves three parts: enabling an API in your Google Cloud project, configuring a policy in Google Admin, and turning on a matching option in your Portnox Cloud Google Workspace integration.

Open the Chrome Verified Access API page. Then, click on the Enable button.

Note:
The link opens the page for whichever project is currently selected in the Google Cloud console. Check the project name shown at the top of the page and make sure it matches the project you used earlier in this topic.
Decide which service account will be authorized to use the Verified Access API. You can reuse the service account you created earlier in this topic for the connector, or create a new one.

Note:
To create a new service account, repeat the relevant steps in the Configure the Google Cloud project section, and copy its email address for use in the next step.

In this example, we will use the same service account that we used for the connector.
Open the Device settings page in the Google Admin console.
In the Organizational units section, search for and click on the organizational unit where you want to enable Verified Access.

Note:
To apply the setting to all devices, leave the top-level organizational unit selected instead.
In the right-hand side pane, in the Enrollment and access table, click on the Verified access setting.
In the Configuration field, check that the value is set to Enable for content protection. This is the Google default, so it should already be selected. If it is set to Disable for content protection instead, click on the field and select the Enable for content protection option, then click on the Save button.
Click on the Device option in the breadcrumb trail on top of the screen to go back to the previous pane, and then in the Enrollment and access table, click on the Verified mode setting.
In the Configuration field, select the Require verified mode boot for verified access option.

Note:
If you select this option, devices in Developer mode will always fail the verified access check. If you have a business reason to allow Developer mode devices to pass verification, select the Skip boot mode check for verified access option instead.
In the Services with full access or Services with limited access field, enter the email address of the service account that you decided to use earlier in this task.

Note:
Google documentation does not specify the exact difference in capabilities between full and limited access. Choose the option that matches your organization’s risk tolerance – full access if you are unsure, or limited access if you prefer to grant the minimum access necessary and can confirm it meets your needs during testing.

In this example, using the service account created earlier in this topic, the value would be scep-prov-service-account@chromebook-cert-provisioning.iam.gserviceaccount.com.
Click on the Save button.
In Portnox Cloud, edit your Google Workspace integration and activate the Enable ChromeOS devices synchronization checkbox.

Result: Portnox Cloud can now validate Google Verified Access policy attributes against Google Workspace during device authentication for ChromeOS risk assessment policies.

Create a profile for the root CA certificate

In this section, you will create a profile in Google Workspace for the downloaded Portnox™ Cloud root CA certificate.

Note:

Open the Google Workspace admin console and access the Devices > Networks > Certificates pane by visiting the following URL: admin.google.com/ac/networks/certificates.
In the Organizational units section, select a specific organizational unit if you want this profile to apply only to the selected organizational unit. Otherwise, leave the default top organizational unit selected.
Click on the ADD CERTIFICATE link.

The Add certificate pane opens.
In the Add certificate pane, enter the name for the profile and then click on the UPLOAD button. Then, select the root CA certificate downloaded and converted earlier.

In this example, we used the name Portnox Cloud root CA, but you can use any name you like.

You will see basic information about the root CA certificate.
In the Certificate Authority section of the Add certificate pane, select Chromebook and optionally all other managed device platforms that you will use this certificate with, and then click on the Add button.

Result: You created a profile for the Portnox Cloud root CA certificate.

Create a Wi-Fi profile

In this section, you will create a Wi-Fi profile in Google Workspace for Chromebooks managed by Portnox™ Cloud.

Note:

If you are upgrading from the legacy Secure SCEP method to the process described in this topic, this profile may already exist. The existing profile will continue to work correctly with the new SCEP process but it’s not optimized because it uses pattern matching instead of a provisioning profile. This may cause problems in the future. If the profile already exists, edit the existing profile instead and make sure that the values match the steps below.

Open the Google Workspace admin console and access the Devices > Networks > Wi-Fi pane by visiting the following URL: admin.google.com/ac/networks/wifi.
In the Organizational units section, select a specific organizational unit if you want this profile to apply only to the selected organizational unit. Otherwise, leave the default top organizational unit selected.
Click on the ADD WI-FI link.

The Add Wi-Fi pane opens.
In the Platform access section of the Add Wi-Fi pane, activate the Enabled checkbox in the Chromebooks (by user) section if you are using user profiles, or in the Chromebooks (by device) section if you are using device profiles.
In the Details section, enter a friendly name for the Wi-Fi profile in the Name field, enter the network SSID in the SSID field, and activate the Automatically connect checkbox.

Note:
The value of the Name field is used only in Google Workspace for organizational purposes. Users see the network SSID in their Chromebooks network configuration.

Important:
If you do not activate the Automatically connect checkbox, Chromebook users may have to manually connect to the network.
In the Security settings section, in the Security Type field, select the WPA/WPA2/WPA3 Enterprise (802.1X) option and in the Extensible Authentication Protocol field that appears, select the EAP-TLS option.
In the Username field, enter the display username.
We recommend that you use ${USER_EMAIL} in this field.
In the Server Certificate Authority field, select the root CA profile you created in the earlier task..

Note:
This root certificate is used to validate the RADIUS server.
In the Server Certificate Domain Suffix Match field, enter portnox.com.
In the Provisioning Type field, select the Certificate profile option, and in the Certificate profile field, select the certificate provisioning profile that you created in the earlier task.
For other fields, leave the default values or adjust values to your requirements and your environment, if needed, then click on the SAVE button to save the Wi-Fi profile.

Result: You created a Wi-Fi profile for the network managed by Portnox Cloud.

Optional: Disable the legacy Secure SCEP configuration

In this section, you will remove the legacy Secure SCEP profile from Google Workspace, so that Chromebooks stop using the older, poll-based certificate enrollment method before you configure the new process.

Important:

If your organization already has a Secure SCEP profile configured from a previous setup, remove it as described in this task before continuing with the next tasks in this topic. If you are configuring Google SCEP for the first time and never configured Google SCEP using the legacy Secure SCEP method, skip this task.

Open the Google Admin console and access the Devices > Networks > Secure SCEP pane by visiting the following URL: admin.google.com/ac/networks/scep.
In the Organizational units section, select the organizational unit where the existing Secure SCEP profile is configured.
In the Secure SCEP pane, click on the trash can icon next to the existing profile.
Click on the Delete button in the confirmation dialog to confirm.

Result: Devices in the selected organizational unit will no longer enroll for certificates using the legacy Secure SCEP method.

Note:

If you are not sure that the new provisioning method will work correctly, you can also reconfigure the existing profile to no longer work for new Chromebook connections temporarily, and delete it later after verifying the new method.

Test your configuration on a managed Chromebook

In this section, you will test the configuration you created by connecting a Chromebook to the network managed by Portnox™ Cloud.

Turn on the Chromebook and sign in with a managed Google account.
Click on the network icon in the status area, then click on the name of the Wi-Fi network managed by Portnox Cloud to connect to it.

Important:
Before the Chromebook can obtain a certificate and connect to this network automatically, it needs Internet access through some other means – for example, a different Wi-Fi network – so it can sign in and complete certificate provisioning with Google. It cannot obtain the certificate through this secured network itself, since it does not have a valid certificate to join it with yet.

Result: The Chromebook connects automatically, using the certificate issued through Google Cloud, Google Workspace, and Portnox Cloud SCEP.

If the Chromebook does not connect, check the following:

Open chrome://certificate-manager, click on the Your certificates tab, and confirm a certificate was issued.
On the Windows server, check that the Google Cloud Certificate Connector service is running, and check its logs in Event Viewer (Windows Logs > Application) for errors.