• New! The SecureW2 Demo Library is live.
Explore Now
Home Knowledge Base SecureW2 Documentation ChromeOS API Google Certificate Provisioning

ChromeOS API Google Certificate Provisioning

Introduction

The Certificate Provisioning Solution is a modern, API-based solution mandated by Google for ChromeOS certificate enrollment, replacing the legacy Simple Certificate Enrollment Protocol (SCEP) model. This transition reflects a broader shift toward a Zero Trust security model.

The Certificate Provisioning Connector cryptographically validates the ChromeOS hardware attestation payload to confirm that each request originates from a trusted, enterprise-enrolled Chromebook with an intact Trusted Platform Module (TPM) chip. Unlike legacy SCEP, which lacks device-level validation, this architecture prevents unauthorized use cases such as credential cloning, where a user might extract a SCEP challenge and use it on an unmanaged device to access corporate resources.

This document outlines the steps to configure secureW2’s Certificate Provisioning API for ChromeOS certificate enrollment, replacing the legacy SCEP solution that uses the Google Connector.

Impact of Not Migrating and Key Deadlines

Google is deprecating the Google SCEP API at the end of 2026. If you don’t migrate before this deadline, you won’t be able to enroll new certificates for your ChromeOS devices. Your existing certificates will remain valid until they expire, and your devices will stay connected — but once they expire, they can’t be renewed. To avoid disruption, migrate to Certificate Provisioning Solution before the deadline.

Prerequisites

The following prerequisites are required to enroll Chromebooks using the Google Certificate Provisioning Connector:

  1. An active subscription to the JoinNow Management portal.
  2. An active Google Workspace or ChromeOS Enterprise license with access to the Google Admin Console.
  3. An active Google Cloud project with access to the Google Cloud Console.

Configuring SecureW2

The following are the high-level steps to set up certificate enrollment for ChromeOS devices using the Google Certificate Provisioning Connector in the JoinNow Management Portal.

  1. Creating a Device Management Platform
  2. Creating a SecureW2 Intermediate CA
  3. Creating a Google Certificate Template
  4. Creating Policies

Creating a Device Management Platform

Google Certificate Provisioning is Google’s API-based implementation of a dynamic SCEP workflow. Unlike legacy SCEP, which uses a static challenge, Certificate Provisioning Connector generates a unique, dynamic challenge for each certificate request.

To create a Device Management Platform, perform the following steps:

  1. Log in to the JoinNow Management Portal.
  2. Navigate to Integration Hub > Device Management Platforms.
  3. Click Add.
  4. In the Basic section, in the Name field, enter the name of the device management platform.
  5. In the Description field, enter the description for the device management platform.
  6. From the Type drop-down list, select Google Certificate Provisioning.
  7. Click Save.
  8. Click the Configuration tab and configure the following settings:
    1. In the Service Account Key File (key.json) field, click Choose file to upload the key file obtained from the Creating a Service Account Key section.
    2. In the Subscription Name field, enter the subscription ID obtained from the Configuring a Pub/Sub Topic section.
    3. Click Validate to check your connection with Google.
  9. Click Update.

Creating a SecureW2 Intermediate CA

SecureW2 recommends using a new intermediate CA as a best practice for enrollments.

To create a new Intermediate CA, perform the following steps:

  1. Navigate to Dynamic PKI > Certificate Authorities. 
  2. Click Add Certificate Authority.
  3. In the Basic section, from the Generate CA For drop-down list, select the Device and User Authentication option to authenticate devices and users.
  4. From the Type drop-down list, select Intermediate CA. 
  5. From the Certificate Authority drop-down list, select the default Root CA that comes with your organization.
  6. For the Common Name field, enter a name.
  7. From the Key Size drop-down list, select 2048 for the CA certificate key pair. 
  8. From the Signature Algorithm drop-down list, select the signature algorithm for the certificate signing request. The option available is SHA-256.
  9. In the Validity Period (in years) field, enter the validity period for the Intermediate CA in terms of the number of years.
  10. In the Notifications section:
    1. From the Expiry Notification Frequency (in days) drop-down list, select the frequency interval for which a certificate expiration notification should be sent to users.
    2. Select the Notify user on successful Enrollment checkbox to notify users after a successful enrollment.
    3. If the RFC has a valid email address, the user will receive a certificate-issued or expired notification; otherwise, they will not.
  11. In the Revocation section:
    1. In the Revoke Certificate if unused for field, select the number of days after which an unused certificate can be revoked.
      1. Since last usage – Select this checkbox to revoke the certificate after a specified number of days if it remains unused.
      2. Since certificate issuance – Select this checkbox to revoke the certificate after a specified number of days after it is issued.
    2. From the Reason Code drop-down list, select any one of the following reasons for which the certificate is revoked. 
      1. Certificate Hold
      2. AA Compromise
      3. Privilege Withdrawn
      4. Unspecified
  12. Click Save. This generates the new intermediate CA.

Creating a Google Certificate Template

A certificate template defines how information is encoded in certificates issued by the Certificate Authority. It includes a list of certificate attributes and specifies how each attribute’s value should be encoded.

To create a Google Certificate Template:

  1. Navigate to Dynamic PKI > Certificate Authorities.
  2. Scroll to the Certificate Templates section and click Add Certificate Template.
  3. In the Basic section, enter the name of the certificate template in the Name field.
  4. In the Subject field, retain the default value. 
  5. In the Display Description field, enter a suitable description for the certificate template.
  6. In the Validity Period field, type the validity period of the certificate (based on the requirement).
  7. To override the Validity Period attribute, select the Override Validity Period checkbox and choose an end date from the date picker to set a hard-coded expiry date for a certificate.
  8. From the Signature Algorithm drop-down list, select SHA-256 as the signature algorithm for the certificate signing request.
  9. In the SAN section:
    1. In the DNS field, enter ${/device/clientId}
  10. In the Extended Key Usage section, from the Use Certificate For list, select Client Authentication.
  11. In the Notification section, select the Notify admin on certificate expiry checkbox to send certificate expiry email notifications to all Admins.
  12. Click Save.

Policy Management

This section outlines the policies required in JoinNow to enable SCEP-based certificate enrollment.

  1. Policy Workflow
  2. Enrollment policy
  3. Network policy

Configuring a Policy Workflow

The Policy Workflow facilitates the segmentation of users and devices based on predefined criteria or associated attributes and groups, with each segment identified as a distinct Policy Workflow. This allows admins to configure the issuance of specific certificate types or formats for each Policy Workflow through an Enrollment Policy.

To create a policy workflow, perform the following steps:

  1. Navigate to Policy Management > Policy Workflows.
  2. Click Add Policy Workflow.
  3. In the Basic section, enter the name of the policy workflow in the Name field.
  4. In the Display Description field, enter a suitable description for the policy workflow.
  5. Click Save. The page refreshes, and the Conditions tab is displayed.
  6. Select the Conditions tab.
  7. From the Core Provider drop-down list, select the API token you created in the Creating a Device Management Platform section.
  8. Click Update.

Configuring an Enrollment Policy

An Enrollment Policy defines the client certificate template and the Certificate Issuer to be used for each Policy Workflow. It leverages the segmentation established in the Policy Workflow to ensure that the appropriate client certificate template is issued for each workflow.

To create an Enrollment policy, perform the following steps:

  1. Navigate to Policy Management > Enrollment.
  2. Click Add Enrollment Policy.
  3. In the Basic section, enter the name of the enrollment policy in the Name field.
  4. In the Display Description field, enter a suitable description for the enrollment policy.
  5. Click Save. The page refreshes, and the Conditions and Settings tabs are displayed.
  6. Select the Conditions tab.
    1. From the Policy Workflow list, select the policy workflow you created earlier (see the Configuring a Policy Workflow section).
    2. From the Device Role list, select DEFAULT DEVICE ROLE POLICY 1.
  7. Select the Settings tab.
    1. In the Settings section, from the Use Certificate Authority drop-down list, select the intermediate CA you created earlier (see the Creating a SecureW2 Intermediate CA​ section).
    2. From the Use Certificate Template drop-down list, select the template you created earlier (see the Creating a Google Certificate Template section).
    3. In the other settings, retain the default values.
  8. Click Update.

Configuring Network Policy

Similar to the Enrollment Policy, the Network Policy applies settings to a particular Policy Workflow. It allows us to specify whether the device will be granted or denied network access, along with other RADIUS attributes that can be sent, which are most commonly VLAN assignments. 

Like with the Enrollment Policy, we are just going to show how to map our Policy Workflow (created in the Creating a Policy Workflow section) to our Network Policy.

  1. Navigate to Policy Management > Network.
  2. Click Add Network Policy.
  3. Under the Basic section, in the Name field, enter the name of the network policy.
  4. In the Display Description field, enter a suitable description for the network policy.
  5. Click Save.
  6. The page refreshes, and the Conditions and Settings tabs appear.
  7. Select the Conditions tab.
  8. Click the Add rule and select the policy workflow you want to assign to this network policy. It is essential to select the appropriate policy workflow to trigger the network policy. This menu offers various rules that you can select based on your business requirements.NOTE: You can assign a network policy to multiple user roles.
  9. Select the Settings tab.
    1. Click Add Attribute.
    2. From the Dictionary drop-down list, select an option: 
      1. Radius: IETF: This is what we will use for the following attributes, as we are using standard RADIUS attributes for VLAN assignment.
      2. Custom: Used for any VSAs (Vendor-Specific Attributes).
    3. From the Attribute drop-down list, select an option.
    4. In the Value field, enter the appropriate value for the attribute.
    5. Click Save.
    6. Repeat for any other RADIUS attribute you would like to send. For reference, here is what is commonly required for VLAN Assignment:
      1. Tunnel-Medium-Type: IEE-802
      2. Tunnel-Private-Group-ID:  {VLAN Name}
      3. Server
Tunnel-Type: VLAN
  10. Click Update.

Every RADIUS Authentication request will run through the policies configured here. Now, when a device attempts to authenticate to the network, we will validate its attributes before deciding whether to grant it access and which VLAN to assign it to.

Configuring Google

This section describes how to configure the Google Workspace Admin Console and Google Cloud for ChromeOS certificate enrollment.

  1. Configuring Google Cloud for ChromeOS certificate enrollment
  2. Configuring Google Workspace Admin Console

Configuring Google Cloud for ChromeOS Certificate Enrollment

This section describes how to set up the Google Cloud infrastructure to communicate with the Certificate Provisioning Connector.

Creating a New Project

To create a new project, perform the following steps:

  1. Log in to Google Cloud.
  2. Open the project selector (top navigation bar), then click New Project.
  3. In the Project Name field, enter a name for the project. The Project ID is automatically populated and serves as the globally unique identifier for the project. The Project ID is editable. You can modify it as required before creating the project.
  4. Click Create.

Configuring a Pub/Sub Topic

Pub/Sub is the messaging service that enables real-time communication between Google and SecureW2’s Certificate Provisioning Connector. When a ChromeOS device requests a certificate, Google publishes the request to the Pub/Sub topic. SecureW2’s Certificate Provisioning Connector subscribes to that topic, receives the request, and forwards it to the Dynamic PKI-driven policy engine to issue the certificate. The issued certificate is then returned to the device.

Pub/Sub is a core requirement of the Certificate Provisioning Solution. Without it, SecureW2’s Certificate Provisioning Connector cannot receive certificate requests from Google in real time.

To configure Topic in the Pub/Sub, perform the following steps:

  1. Open the project selector and select the project that you created in the Creating a New Project section.
  2. In the search bar, search for Topics and select it.
  3. Click Create topic.
  4. On the Create topic page, enter a name in the Topic ID field. The Topic name is automatically populated and serves as the globally unique identifier for the topic. Copy the topic name to a text editor for later use.
  5. Click Create. 
  6. Copy the Topic name to a text editor. You will need it when configuring the Certificate Authority Connection in the Google Admin Console.
  7. Copy the Subscription ID to a text editor. You will need it to configure the Certificate Provisioning Connector in the JoinNow Management Portal.
  8. On the Permissions tab, click Add principal. 
  9. On the Grant access to pane:
    1. In the Add principals field, enter cert-provisioning-api-pubsub-publisher@system.gserviceaccount.com
    2. In the Assign roles section: 
      1. From the Role drop-down list, select Pub/Sub Publisher. 
      2. Click Add another role.
      3. From the Role drop-down list, select Pub/Sub Subscriber.
    3. Click Save.
  10. Click Add Principal again to add the service account email address.
  11. On the Grant access to pane:
    1. In the Add principals field, enter the service account email address that you copied in the Creating a Service Account section.
    2. In the Assign roles section: 
      1. From the Role drop-down list, select Pub/Sub Publisher. 
      2. Click Add another role.
      3. From the Role drop-down list, select Pub/Sub Subscriber.
    3. Click Save.

Creating a Service Account

This section describes how to create and configure a service account in Google Cloud. 

  1. Navigate to IAM & Admin > Service Accounts.
  2. Click Create service account.
  3. On the Create Service Account page: 
    1. In the Create Service Account section, provide the following details:
      1. In the Service account name field, enter a name for the service account. The name you enter also serves as the service account ID. Copy the service account email address to a text editor. You will need it in the Creating a Certificate Authority Connection section.
      2. Click Create and continue. The service account is created, and you are directed to the next step.
    2. In the Permissions (optional) section, assign the following roles to grant the service account access to the Certificate Provisioning project:
      1. From the Select a Role drop-down list, select API Management Admin (Beta).
      2. Click Add another role.
      3. From the Select a Role drop-down list, select Pub/Sub Publisher.
      4. Click Add another role.
      5. From the Select a Role drop-down list, select Pub/Sub Subscriber.
      6. Click Done to save the service account.

Enabling Chrome Management API

The Chrome Management API is enabled to allow the Google Cloud project to communicate with SecureW2 Certificate Provisioning Connector for ChromeOS device enrollment.

This section describes how to enable the Chrome Management API for your Google Cloud project.

  1. In the search bar, search for Chrome Management API and select it.
  2. Click Enable to activate the Chrome Management API for the project.

Creating a Service Account Key

This section describes how to create and download a JSON key for the service account you created in the Creating a Service Account section.

  1. Navigate to IAM & Admin > Service Accounts and select the service account you created.
  2. Select the Keys tab.
  3. Click Add Key and select Create new key.
  4. Select JSON as the key type and click Create. The key file is downloaded to your machine.

    NOTE    : Store the downloaded JSON key file in a secure location. You will need it to configure the Certificate Provisioning Connector in the JoinNow Management Portal.

Configuring Google Workspace Admin Console

This section describes how to configure the Google Admin Console to connect the Certificate Provisioning Connector with the intermediate CA configured in the JoinNow Management Portal and define how ChromeOS devices request certificates.

Adding the Intermediate CA Certificate to the Server CA Certificates

To upload the intermediate CA certificate from the JoinNow Management Portal to the Server CA certificates, perform the following steps:

  1. Log in to the Google Workspace Admin Console.
  2. Navigate to Devices > Networks > Certificates > Server Certificate Authority Certificates.
  3. To download the intermediate CA certificate from the JoinNow Management Portal:
    1. Log in to the JoinNow Management Portal.
    2. Navigate to Dynamic PKI > Certificate Authorities. 
    3. Click Download to save the intermediate CA certificate created in the Creating a SecureW2 Intermediate CA section.
  4. Click ADD CERTIFICATE and upload the intermediate CA certificate from the JoinNow Management Portal.
  5. On the Add certificate page:
    1. In the Name field, enter a name for the certificate.
    2. Click UPLOAD to upload the intermediate CA certificate downloaded from the JoinNow Management Portal.
    3. Select the Enabled for Chromebook option.
    4. Click Add.

Creating a Certificate Authority Connection

To create a Certificate Authority Connection in the Google Admin Console, perform the following steps:

  1. Navigate to Devices > Networks > Certificates > Certificate Authority connections.
  2. Click ADD CONNECTION.
  3. On the Add Certificate Authority connection page:
    1. In the Certificate Authority Connection Type field, select Generic Certificate Authority connection.
    2. In the Certificate Authority connection name field, enter a name that identifies the purpose of the connection in the Google Admin Console.
    3. In the Service account field, enter the service account email address that you copied in the Creating a Service Account section.
    4. In the Pub/Sub topic field, enter the topic name that you copied in the Configuring a Pub/Sub Topic section.
    5. In the Certificate Authority connection configuration identifier field, enter the exact name of the intermediate CA certificate that you uploaded in the Adding the Intermediate CA Certificate to the Server CA Certificates section.
    6. Click Add.

Creating a Certificate Provisioning Profile

This section describes how to create a Certificate Provisioning Profile in the Google Admin Console.

  1. Navigate to Devices > Networks > Certificates > Certificate provisioning profiles.
  2. Click ADD PROFILE.
  3. On the Add Certificate provisioning profile page:
    1. From the Referenced Certificate Authority connection drop-down list, select the  Certificate Authority Connection that you created earlier.
    2. In the Certificate provisioning profile name field, enter a name to identify the certificate provisioning profile in the Google Admin Console.
    3. In the Certificate provisioning profile config reference field, enter the exact name of the certificate template created in the JoinNow Management Portal.
    4. From the Encryption key type drop-down list, select RSA Key – 2048bit.
    5. Click ADD.

Deployment and Certificate Issuance

SecureW2 administrators can verify successful certificate enrollment by navigating to Data and Monitoring > Enhanced Events in the JoinNow Management Portal.

The RADIUS Events page details the device lookup attributes. To access the RADIUS Events page, log in to the JoinNow Management Portal and navigate to Data and Monitoring > RADIUS Events.

More Google Explainers