Install the Cisco Umbrella Root Certificate

A root certificate is required in any circumstance where Umbrella must proxy and decrypt HTTPS traffic intended for a website. For identities that are configured to use a DNS policy, this must be the Cisco Umbrella root certificate. For identities that are configured to use the Web policy, this can be either the Cisco Umbrella root certificate or your own CA signed root certificate.

The procedures on this page describe how to download and install the Cisco Umbrella root certificate. These procedures can also be used to install your own CA signed root certificate.

Table of Contents

• Prerequisites
• Automatically Install the Cisco Umbrella Root Certificate (For an Active Directory Network)
• Install the Cisco Umbrella Root Certificate with Group Policy Using the Microsoft Management Console (MMC)
• Install the Cisco Umbrella Root Certificate with Group Policy Using the Group Policy Management Console (GPMC)
• Install the Cisco Umbrella Root Certificate in Firefox Using Group Policy
• Install the Cisco Umbrella Root Certificate on Chromebooks Using the Google Admin Console
• Manually Install the Cisco Umbrella Root Certificate (Single Computer)
  • Install the Cisco Umbrella Root Certificate in Edge or Chrome on Windows
  • Install the Cisco Umbrella Root Certificate in Firefox on Windows
  • Install the Cisco Umbrella Root Certificate in All Browsers on Mac OS X
  • Install the Cisco Umbrella Root Certificate on Mac OS X Through the Command Line
  • Install the Cisco Umbrella Root Certificate in Chromium or Chrome on Linux

Prerequisites

• You must be a local administrator over the computer or a network administrator over the network.

Automatically Install the Cisco Umbrella Root Certificate (For an Active Directory Network)

As a network administrator of an Active Directory network environment, you can automatically install the Cisco Umbrella root certificate in all of your users' browsers by creating a Group Policy Object (GPO) on your Active Directory server. This can be created by using either the Microsoft Management Console (MMC) or the Group Policy Management Console (GPMC).

Install the Cisco Umbrella Root Certificate with Group Policy Using the Microsoft Management Console (MMC)

1. In Umbrella, navigate to Deployments > Configuration > Root Certificate, expand Cisco Root Certificate Authority, and download the Cisco Umbrella root certificate. Alternatively, download the root certificate here.

2. Log into your Active Directory server using a domain administrator account.
3. Select Start > All Programs > Administrative Tools > Active Directory Users and Computers. The Microsoft Management Console (MMC) is displayed.
4. To create a domain-wide policy, right-click your domain root Organizational Unit (OU), which is displayed as your domain name, and select Properties from the context menu.
5. In the <OU_Name> Properties dialog box, click the Group Policy tab.
6. Click New, name the policy Umbrella Certificate Installer, and press Return / Enter.
7. Select the new Group Policy Object and click Edit. The Group Policy Object Editor is displayed.
8. In the configuration options sidebar, expand Computer Configuration > Windows Settings > Security Settings > Public Key Policies, right-click Trusted Root Certification Authorities, and select Import.
9. In the Certificate Import wizard, click Next, and in the File to Import page, click Browse. Navigate to where you downloaded the certificate authority on your local system, and double-click the Cisco_Umbrella_Root_CA.cer file.
10. With the full path to the certificate displayed in the File name field, click Next.
11. Accept the default option, place all certificates in the following store (Trusted Root Certification Authorities), click Next, and then click Finish and OK.

You have now created the Group Policy Object to install the Cisco Umbrella root certificate on all of the computers in your domain. The new policy may not take effect immediately on all client machines. By default, the background synchronization processing happens every 90 to 120 minutes at randomized times. Rebooting client machines forces the synchronization.

You can check that the Group Policy has propagated to all computers in the domain by opening your browser on a workstation, opening Tools > Internet Options > Content > Certificates > Trusted Root Certification Authorities, and ensuring that the Cisco Umbrella root certificate is present.

Install the Cisco Umbrella Root Certificate with Group Policy Using the Group Policy Management Console (GPMC)

The Microsoft Group Policy Management Console (GPMC) with Service Pack 1 (SP1) unifies the management of Group Policy across the enterprise. The GPMC consists of an MMC snap-in and a set of programmable interfaces for managing Group Policy.

1. Navigate to Deployments > Configuration > Root Certificate, expand Cisco Root Certificate Authority, and download the Cisco Umbrella root certificate. Alternatively, download the root certificate here.

2. Log into your Active Directory server using a domain administrator account.
3. Select Start > All Programs > Administrative Tools > Group Policy Management. The Group Policy Management Console (GPMC) appears.
4. To create a domain-wide policy, right-click your domain root Organizational Unit (OU), which is displayed as your domain name, and select Create and Link a GPO Here from the context menu.
   The New GPO dialog box appears.
5. In the Name field of the New GPO dialog box, enter a meaningful name for the policy object.
6. Right-click the new Group Policy Object, Umbrella Certificate Installer, on the right side of the window, and select Edit from the context menu. The Group Policy Object Editor appears.
7. In the left configuration options sidebar, expand Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies, right-click Trusted Root Certification Authorities, and select Import from the context menu.
8. In the Certificate Import wizard click Next, and in the File to Import page, click Browse and navigate to where you downloaded the certificate authority on your local system, and double-click the Cisco_Umbrella_Root_CA.cer file.
9. With the full path to the certificate displayed in the File name field, click Next.
10. Accept the default option, Place all certificates in the following store (Trusted Root Certification Authorities), click Next, then click Finish and OK.

You have now created the Group Policy Object to install the Cisco Umbrella root certificate on all of the computers in your domain. The new policy may not take effect immediately on all client machines. By default, the background synchronization processing “only” happens every 90 to 120 minutes (at randomized times). Rebooting client machines forces the synchronization.

You can check that the Group Policy has propagated to all computers in the domain by opening your browser on a workstation, opening Tools > Internet Options > Content > Certificates > Trusted Root Certification Authorities, and ensuring that the Cisco Umbrella root certificate is present.

Install the Cisco Umbrella Root Certificate in Firefox Using Group Policy

By default, Group Policy cannot configure Firefox. In general, deploying the Cisco Umbrella root certificate can be difficult for Firefox users because there is no built-in way to centrally manage Firefox. For information on how Firefox can be configured to trust certificates in the Windows certificate store, see Configuring Firefox to use the Windows Certificate Store.

Install the Cisco Umbrella Root Certificate on Chromebooks Using the Google Admin Console

Using the Google Admin console, you can deploy certificates to your Chromebooks. For more information, see Set Up Certificates.

Manually Install the Cisco Umbrella Root Certificate (Single Computer)

Install the Cisco Umbrella Root Certificate in Edge or Chrome on Windows

1. Navigate to Deployments > Configuration > Root Certificate, expand Cisco Root Certificate Authority, and download the Cisco Umbrella root certificate. Alternatively, download the root certificate here.

2. Click Install Certificate.
3. In the Certificate Import wizard, click Next.
4. In the Certificate Store window, select Place all certificates in the following store and then click Browse.
5. In the Select Certificate Store window, select Trusted Root Certification Authorities and click OK.
   In the Certificate Store window, the Certificate store shows Trusted Root Certification Authorities.
6. Click Next and then click Finish.
7. In the Security Warning windows, click Yes to install the certificate.
   The Certificate Import wizard will notify you that "The import was successful."
8. Click OK.
9. Restart the browser.

Install the Cisco Umbrella Root Certificate in Firefox on Windows

1. Navigate to Deployments > Configuration > Root Certificate, expand Cisco Root Certificate Authority, and download the Cisco Umbrella root certificate. Alternatively, download the root certificate here.

2. Click the Open Menu icon near the top right-hand corner of the browser window.
3. Click Options > Advanced > Certificates > View Certificates > Authorities > Import.
4. Browse for and select the Cisco Root Cert, downloaded in the first step.
5. Select Trust this Certificate to identify websites, then click OK and OK again.
6. Restart Firefox.
   The Firefox certificate store can also be manipulated from the command line using the certutil tool from the NSS Tools package. For more information, see Using the Certificate Database Tool.

Install the Cisco Umbrella Root Certificate in All Browsers on Mac OS X

1. Navigate to Deployments > Configuration > Root Certificate, expand Cisco Root Certificate Authority, and download the Cisco Umbrella root certificate. Alternatively, download the root certificate here.

2. Double-click the file or drag and drop it on top of the Keychain Access icon in the Applications | Utilities folder. The Add Certificate window appears.
3. Click Always Trust.
4. Double-click the Cisco Umbrella root certificate to open its properties window. From the When using this certificate drop-down menu, choose Always Trust.

Install the Cisco Umbrella Root Certificate on Mac OS X Through the Command Line

1. Navigate to Deployments > Configuration > Root Certificate, expand Cisco Root Certificate Authority, and download the Cisco Umbrella root certificate. Alternatively, download the root certificate here.

2. Run the following command:

sudo /usr/bin/security add-trusted-cert -d -r trustRoot -p ssl -p basic -k /Library/Keychains/System.keychain /path/to/Cisco_Umbrella_Root_CA.cer

Install the Cisco Umbrella Root Certificate in Chromium or Chrome on Linux

1. Navigate to Deployments > Configuration > Root Certificate, expand Cisco Root Certificate Authority, and download the Cisco Umbrella root certificate. Alternatively, download the root certificate here.

2. Open Chromium Settings.
3. Scroll down to HTTPS/SSL.
4. Click Manage certificates.
5. Click Authorities.
6. Click Import.
7. Select the Cisco_Umbrella_Root_CA.cer file and click Open.
8. Select Trust this CA to identify Websites.
9. Click OK.

Manage Certificates < Install the the Cisco Umbrella Root Certificate > Add Customer CA Signed Root Certificate