Block Page HTTPS Errors: Installing the CleanBrowsing Root CA

When HTTPS enabled domains are blocked by a policy, CleanBrowsing presents a block page to you which is also served over HTTPS. This block page is encrypted with a certificate signed by the CleanBrowsing Root CA. In order to avoid certificate errors when accessing the block page, you must install the CleanBrowsing Root CA in your browser, or if you have a network of computers, in your users’ browsers.  

Available on the Pro100 +

Why take this step?

CleanBrowsing’s Block Page and Block Page Bypass feature presents an SSL certificate to browsers that make connections to HTTPS sites. The certificate will match the requested site but will be signed by the CleanBrowsing Root Certificate Authority (CA) or the CleanBrowsing Root Certificate Authority. If the CleanBrowsing Root CA is not trusted by your browser, an error may be displayed.

Example errors include:

“”The security certificate presented by this website was not issued by a trusted certificate authority”	Internet Explorer
“The site’s security certificate is not trusted!”	Google Chrome
“This Connection is Untrusted”	Mozilla Firefox

To avoid these errors entirely, install the CleanBrowsing Root CA in your browser, or the browsers of your users (if you’re a network admin). This can be done on a per-browser, per-machine basis for personal use or for small deployments.

For larger deployments, an automatic installation via Group Policy (GPO) can be done. Note that the automatic installation via GPO will only work for users with Internet Explorer or Chrome on Windows systems. As such, so if your network includes some users who use Firefox or Safari browsers, and for users on non-Windows operating systems, the manual installation procedures must be followed.

This article describes the procedures required to manually install the CleanBrowsing Root CA in your browser

IMPORTANT: You must be a local administrator over the computer (or a network administrator over the network) in order to perform these steps. 

Installing CleanBrowsing Root Certificate.

First, download our root certificate. Located here:

https://my.cleanbrowsing.org/download/CleanBrowsing-Filter-BlockPage-CA.crt

Deploying the Certificate using Terminal (Command Prompt)

On a MacOS, run these commands in the terminal:

wget -P ~/Downloads https://my.cleanbrowsing.org/download/CleanBrowsing-Filter-BlockPage-CA.crt

sudo /usr/bin/security add-trusted-cert -d -r trustRoot -p ssl -p basic -k /Library/Keychains/System.keychain ~/Downloads/CleanBrowsing-Filter-BlockPage-CA.crt

If you’re on a Windows device, you can run the following command prompt:

certutil -addstore -enterprise -f Root CleanBrowsing-Filter-BlockPage-CA.crt

Installing the CA in Internet Explorer or Chrome on Windows

To manually install the CleanBrowsing Root CA in your Internet Explorer browser, use the following procedure. Chrome uses Internet Explorer’s certificate store, so the same procedure will also configure Chrome.

• Download the CleanBrowsing Root CA file (see above). Note: If the Open File – Security Warning dialog is displayed, click Open.
• Click Install Certificate.
• In the Certificate Import Wizard window click Next.
• In the Certificate Store window, select Place all certificates in the following store and then click Browse.
• In the Select Certificate Store window, select “Trusted Root Certification Authorities” and click OK.
• In the Certificate Store window, the Certificate store: shows Trusted Root Certification Authorities. Click Next then click Finish.
• In the Security Warning windows, click Yes to install the certificate.
• The Certificate Import Wizard will notify you that “The import was successful.” Click OK to finish.
• Exit Internet Explorer and restart it.

Installing the CA in Firefox on Windows

To manually install the CleanBrowsing Root CA in your Firefox browser on Windows, use the following procedure. This procedure assumes that you, the computer administrator, have already downloaded the CleanBrowsing Root CA and that you have sufficient access privileges to install the certificate on the local system.

• Download the CleanBrowsing Root CA file from the links at the bottom of this article, or from the dashboard. Click on the “Open Menu” icon near the top right hand corner of the browser window.
• Click Options > Advanced > Certificates > View Certificates > Authorities > Import….
• Browse for and select the CleanBrowsing Root Cert, downloaded in the first step.
• Select “Trust this CA to identify websites”, then click OK.
• Restart the Firefox browser. 

The Firefox certificate store can also be manipulated from from the command line using the certutil tool from the NSS Tools package. For more information, please see the following Mozilla documentation:

https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/tools/NSS_Tools_certutil

Installing the CA with Group Policy Using the Group Policy Management Console (GPMC)

The Microsoft Group Policy Management Console (GPMC) with Service Pack 1 (SP1) unifies management of Group Policy across the enterprise. The GPMC consists of an MMC snap-in and a set of programmable interfaces for managing Group Policy.

• Download the CleanBrowsing Root CAs below.
• Log in to your Active Directory server using a domain administrator account.
• Select Start | All Programs | Administrative Tools | Group Policy Management. The Group Policy Management Console (GPMC) is displayed.
• To create a domain wide policy, right-click on your domain root Organizational Unit (OU), which is displayed as your domain name, and select Create and Link a GPO Here from the context menu. The New GPO dialog box is displayed.
• In the Name field of the New GPO dialog box, enter a meaningful name for the policy object, such as CleanBrowsing Certificate Installer.
• Right-click the new Group Policy Object, CleanBrowsing Certificate Installer, on the right side of the window, and select Edit from the context menu. The Group Policy Object Editor is displayed.
• In the left configuration options sidebar, expand Computer Configuration | Policies | Windows Settings | Security Settings | Public Key Policies, right-click Trusted Root Certification Authorities, and select Import from the context menu.
• In the Certificate Import Wizard click Next, and in the File to Import page, click Browse and navigate to where you downloaded the certificate authority on your local system, and double-click the CleanBrowsing_Root_CA.cer file.
• With the full path to the certificate displayed in the File name field, click Next.
• Accept the default option, Place all certificates in the following store (Trusted Root Certification Authorities), click Next, and then click Finish and OK.

You have now created the Group Policy Object to install the certificates on all the computers in your domain. The new policy may not take affect immediately on all client machines. By default, the background synchronization processing “only” happens every 90 to 120 minutes (at randomized times). Rebooting the client machines will force the synchronization.

You can check that the Group Policy has propagated to all computers in the domain by opening Internet Explorer on a workstation PC, opening Tools|Internet Options | Content | Certificates | Trusted Root Certification Authorities, and ensuring that the CleanBrowsing Root CA certificate is present.

Installing the CAs in Firefox using Group Policy

By default, Group Policy cannot configure Firefox. In order to do so, Group Policy must be extended to include configuration options for Firefox. Firefox ADMX is a way of allowing centrally managed locked and/or default settings in Firefox via Group Policy and Administrative Templates in Active Directory. Firefox ADMX is a continuation of Firefox ADM by Mark Sammons.

You can find installation instructions on the FirefoxADMX website.