> For the complete documentation index, see [llms.txt](https://docs.scepman.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.scepman.com/certificate-management/static-certificates/google-workspace/chromeos.md). # ChromeOS This document describes deploying a device and/or user certificates for ChromeOS devices. The deployment of the SCEPman Root Certificate is mandatory. {% hint style="danger" %} **Google is retiring legacy SCEP for ChromeOS.** Google has announced that the legacy SCEP API used for ChromeOS certificate enrollment will be retired by the end of 2026, in favor of the new **ChromeOS Certificate Provisioning API.** Certificates already issued via SCEP will remain valid until they expire, but cannot be renewed once the legacy API is retired. SCEPman support for the Certificate Provisioning API will be covered in a separate guide once available. For details, see [Google's ChromeOS certificate enrollment documentation](https://support.google.com/chrome/a/answer/11338941?hl=en). {% endhint %} ## Root Certificate As a first step, you must deploy SCEPman's root certificate. Therefore, follow these steps: 1. Download the root CA certificate from your SCEPman website by clicking on the **Get CA Certificate** link.

2. Now upload your SCEPman root CA to your Google Workspace. In your Google **Admin console** (admin.google.com) navigate to **Menu** > **Devices** > **Networks** > **Certificates** > **ADD CERTIFICATE** {% hint style="warning" %} Be aware that the Google Admin console only accepts certificates in PEM format. You will need to convert SCEPman root CA (which is downloaded in DER by default) using *openssl* or by importing it in Windows and exporting it again in Base-64 format. {% endhint %}

## Add a SCEP Profile The SCEP profile defines the certificate that lets users access your WiFi. Assign the profile to specific users by adding it to an organizational unit. Set up multiple SCEP profiles to manage access by device type. The following configuration example 1. In your Google **Admin console** (admin.google.com) navigate to **Menu** > **Devices** > **Network** 2. Click **Create SCEP Profile**. 3. Click **Add Secure SCEP Profile**. 4. Enter the configuration details for the profile. | Attribute | Value (Device) | Value (User) | | -------------------- | ------------------- | ----------------- | | **Device platforms** | Chromebook (device) | Chromebook (user) |

| Attribute | | | --------------------- | ------------------------------------- | | **SCEP profile name** | Provide a name for your SCEP profile. |

Attribute	Value (Device)	Value (User)
Subject name format	Fully distinguished name	Fully distinguished name
	Common name: ${DEVICE_SERIAL_NUMBER}	Common name: ${USER_EMAIL}
	Company name: Your company name.	Company name: Your company name.
	Organization unit: Your organizational unit. This is optional.	Organization unit: Your organizational unit. This is optional.
	Locality: Your organization unit's location. This is optional.	Locality: Your organization unit's location. This is optional.
	State: Your organization unit's state. This is optional.	State: Your organization unit's state. This is optional.
	Country / region: Your organization unit's country. This is optional.	Country / region: Your organization unit's country. This is optional.
Subject alternative name	Default: None This can be set to Custom when the SAN shall be used, e.g. as outer identity when authenticating to a WiFi using EAP-TLS.	Custom User Principal: ${USER_EMAIL_NAME}

| Attribute | Value | | --------------------- | ------------------------------------------ | | **Signing algorithm** | SHA256withRSA | | **Key usage** | Key encipherment, Signing | | **Key size (bits)** | 3072 | | **Security** | Strict (only supported by managed devices) |

Attribute	Value
SCEP server attributes	SCEP server URL: http://scepman.yourdomain.net/static
	Certificate validity period (years): 1
	Renew within days: 42
	Extended key usage: Client authentication
	Challenge type: Static
	Challenge: Provide the challenge value you have configured when enabling the SCEPman Google Workspace integration.
	Certificate Authority: Reference here the certificate profile containing your SCEPman Root CA.
	Network type this profile applies to: Wi-Fi

5. The SCEP profile is automatically distributed to users in the organizational unit. 6. To check for this certificate, in your Chromebook navigate to **chrome://certificate.manager** > **Your certificates.**

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.scepman.com/certificate-management/static-certificates/google-workspace/chromeos.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.