How-To: Set Up Certificate-Based Wi-Fi on Chromebooks with Keytos Shield and the Google Cloud Certificate Connector (GCCC)

Overview - How to Connect Chromebooks to Passwordless Wi-Fi with Keytos Shield

Chromebooks managed in Google Workspace can’t request certificates from Keytos Shield on their own. Google brokers every certificate request through the Google Cloud Certificate Connector (GCCC), a small Windows service that you run on a server in your environment. The connector receives each Chromebook’s certificate request from Google, sends it to your Keytos Shield static SCEP endpoint, and returns the signed certificate to the device. The private key never leaves the Chromebook.

This guide walks you through every piece: enabling static SCEP in Keytos Shield, preparing the Google Cloud project the connector uses, installing GCCC, and configuring Google Admin to push both the Shield CA certificates and an EAP-TLS Wi-Fi network. Once you’re done, your Chromebooks receive a certificate and connect to your Wi-Fi automatically, with no passwords.

How Chromebook Certificate Provisioning Works with Keytos Shield

1. Google Admin sends a managed Chromebook your certificate provisioning profile and Wi-Fi network: at boot for device certificates, or when the user signs in for user certificates.
2. The Chromebook generates a key pair and sends a certificate request to Google.
3. Google publishes the request to a Pub/Sub topic in your Google Cloud project.
4. The Google Cloud Certificate Connector on your Windows server picks up the request and sends it to your Keytos Shield static SCEP URL, using the Shield static SCEP password.
5. Keytos Shield issues the certificate. The connector hands it back to Google, which installs it on the Chromebook.
6. The Chromebook connects to your Wi-Fi with EAP-TLS. It trusts your Shield RADIUS servers because Google Admin pushed your Shield Root CA as the server CA.

Prerequisites for Issuing Keytos Shield Certificates to Chromebooks

Before you begin, make sure you have completed these prerequisites:

1. The Keytos Entra ID applications are registered in your tenant.
2. You have signed up for a Keytos Shield Plan.
3. You are a Subscription Owner or Network Administrator.
4. You have completed the Keytos Shield Network Security onboarding and have a network profile for the SSID your Chromebooks will join.
5. You are a Google Workspace super administrator.
6. Your Chromebooks are enrolled in Google Workspace with a Chrome Enterprise or Chrome Education Upgrade license, and run ChromeOS 138 or later.
7. You can create a project with billing enabled in Google Cloud.
8. You have a Windows Server (or Windows machine that stays on) with outbound HTTPS access to Google and to your Keytos Shield SCEP URL. GCCC runs there as a Windows service.

Step-by-Step Guide - How to Configure Chromebook Wi-Fi Certificates with Keytos Shield and GCCC

Step 1 - How to Enable Static SCEP in Keytos Shield

Keytos Shield only shows enrollment details for the MDMs you tell it about. Saving your selection also updates your certificate authority to support static SCEP.

1. Log in to your Keytos Shield portal.
2. From the left-hand menu, select Network profiles.
3. At the top of the page, select the Settings tab.
4. Expand Mobile Device Management.
5. Check Other MDM, in addition to any other MDMs you already use.
6. Click Save MDM Configuration.

Step 2 - How to Get Your Keytos Shield Static SCEP URL, Password, and CA Certificates

You need three things from Keytos Shield: the static SCEP URL and password for the connector, and your Shield CA certificates for Google Admin.

How to Copy Your Static SCEP URL and Password

1. Log in to your Keytos Shield portal.

2. From the left-hand menu, navigate to Network profiles.

3. At the top of the page, select the Settings tab.

   

4. Expand Certificate Authority and Enrollment, and then expand your MDM, such as NinjaOne or SimpleMDM.

   Not seeing your MDM? Make sure to enable it under the Mobile Device Management section further up on the page and save your changes.

5. Click the Copy button next to the Static SCEP URL.

   

6. Click the Copy button next to the Static SCEP password to copy the password without displaying it. You will need both values when you create the SCEP profile in your MDM.

Keep the password somewhere safe, such as your password manager. You’ll save it on the connector server in Step 5.

How to Download Your Keytos Shield Root and Issuing CA Certificates

1. Log in to your Keytos Shield portal.

2. From the left-hand navigation bar, click on Network Profiles.

3. At the top of the page, select the Settings tab.

   

4. Scroll down to the Certificate Authority and Enrollment section and expand the Other MDM subsection.

   Not seeing the Other MDM subsection? Make sure to enable Other MDM under the Mobile Device Management section further up on the page and save your changes.

5. Next to rootca.cer, click Download and save it to your local machine.

6. Next to issuingca.cer, click Download and save it to your local machine as well.

   

Step 3 - How to Create the Google Cloud Project and Pub/Sub Topic for GCCC

Google delivers Chromebook certificate requests to the connector through Pub/Sub in a Google Cloud project that you own. Create a dedicated project for the connector so its permissions stay separate from everything else.

How to Create the Google Cloud Project

1. Go to the Google Cloud console and sign in with your Google Workspace administrator account.

2. Enter a Project name, such as Keytos Shield GCCC. Note the Project ID shown underneath; you’ll use it in the connector configuration.

3. Make sure the Organization is your Google Workspace domain, and then click Create.

   

How to Create the Pub/Sub Topic and Subscription

1. With your new project selected, go to Pub/Sub > Topics. If prompted, let Google Cloud enable the Pub/Sub API.

2. Click Create topic.

3. Enter a Topic ID, such as keytos-shield-gccc, and copy the full Topic name shown underneath (projects/<project-id>/topics/<topic-id>).

4. Keep Add a default subscription checked. Google creates a subscription named <topic-id>-sub, which the connector listens to.

5. Click Create.

   

How to Enable the Chrome Management API

The connector returns issued certificates to Google through the Chrome Management API.

1. Go to APIs & Services > Library, and search for Chrome Management API.

2. Click Enable.

   

How to Create the Connector Service Account

1. Go to IAM & Admin > Service Accounts, and click Create service account.

2. Enter a Service account name, such as Keytos Shield GCCC, and copy the service account Email address. You’ll need it in Google Admin.

3. Click Create and continue.

   

4. Under Permissions, add the Pub/Sub Subscriber and Pub/Sub Publisher roles, and then click Done.

   

How to Let Google Publish Certificate Requests to Your Topic

Google sends Chromebook requests from its own service account, so it needs permission to publish to your topic.

1. Go back to Pub/Sub > Topics and open your topic.

2. In the Permissions panel on the right, click Add principal.

3. In New principals, enter cert-provisioning-api-pubsub-publisher@system.gserviceaccount.com.

4. In Role, select Pub/Sub Publisher.

5. Click Save.

   

How to Create the Connector’s Service Account Key

1. Go to IAM & Admin > Service Accounts, and click your connector service account.

2. Open the Keys tab, and click Add key > Create new key.

3. Keep JSON selected, and click Create. Your browser downloads the key file.

   

Treat this file like a password. Anyone who has it can read your certificate requests. Copy it only to the connector server, and delete any other copies once the connector is running.

Step 4 - How to Download and Install the Google Cloud Certificate Connector

1. Sign in to the Google Admin console as a super administrator.

2. From the left-hand menu, navigate to Devices > Networks.

   

3. Expand Certificates, click Certificate Authority connections, and then click Download connector.

   

4. On the Google Cloud Certificate Connector page, click Download.

   

5. Copy the installer to your Windows server, and run it as an administrator. The installer adds the GoogleCloudCertificateConnector service to C:\Program Files\Google\Google Cloud Certificate Connector.

Step 5 - How to Configure and Start the Google Cloud Certificate Connector

The connector reads three files from its installation folder, C:\Program Files\Google\Google Cloud Certificate Connector.

1. Copy the service account key you downloaded in Step 3 into the folder, and rename it to adapter_key.json.

2. In the same folder, create adapter_config.json with the following content. Replace the project ID, subscription, and SCEP URL with your own values. Choose any value for ca_connection_config_id; you’ll enter the same value in Google Admin in Step 7.

   {
     "adapter_configuration": {
       "request_subscriptions": [
         "projects/<project-id>/subscriptions/<topic-id>-sub"
       ],
       "key_filename": "adapter_key.json",
       "instance_id": "keytos-shield-gccc-connector-1",
       "log_level": "info"
     },
     "ca_configurations": [
       {
         "type": "SCEP",
         "ca_connection_config_id": "keytos-shield-static-scep",
         "ca_endpoint_url": "<your Keytos Shield Static SCEP URL>",
         "challenge_filename": "challenge.txt"
       }
     ]
   }
   

3. Save your Keytos Shield static SCEP password to challenge.txt in the same folder, with no trailing line break. In Keytos Shield, click Copy next to Static SCEP password, and then run the following in an elevated PowerShell window on the server. It also limits the file so only administrators and the connector’s LOCAL SERVICE account can read it.

   $d = 'C:\Program Files\Google\Google Cloud Certificate Connector'
   Get-Clipboard -Raw | ForEach-Object { $_.Trim() } | Set-Content -Path "$d\challenge.txt" -NoNewline -Encoding ascii
   icacls "$d\challenge.txt" /inheritance:r /grant "Administrators:F" /grant "SYSTEM:F" /grant "NT AUTHORITY\LOCAL SERVICE:R"
   

4. Start the connector and set it to start automatically:

   Set-Service GoogleCloudCertificateConnector -StartupType Automatic
   Start-Service GoogleCloudCertificateConnector
   

5. Confirm the connector is listening. Open Event Viewer > Windows Logs > Application, and look for an event from GoogleCloudCertificateConnector that says Listening to requests... for your subscription:

   Info: SubID:"keytos-shield-gccc-sub" Listening to requests...
   

Step 6 - How to Upload the Keytos Shield CA Certificates to Google Admin

Chromebooks need to trust your Shield Root CA to validate your Shield RADIUS servers, and Google needs your Shield CAs to build the certificate chain.

1. In the Google Admin console, go to Devices > Networks and expand Certificates.

2. Click Server Certificate Authority certificates.

   

3. Click Add certificate.

4. Enter a Name, such as Keytos Shield Root CA, click Upload, and select rootca.cer.

5. Check Enabled for Chromebook, and then click Add.

   

6. Repeat these steps for issuingca.cer, naming it Keytos Shield Issuing CA.

When you’re done, both certificates show Chromebook in the Certificate Authority for column.

Step 7 - How to Add the Keytos Shield SCEP Certificate Authority Connection in Google Admin

The CA connection tells Google which Pub/Sub topic to send requests to, and which connector configuration should handle them.

1. In Devices > Networks > Certificates, click Certificate Authority connections, and then click Add connection.

2. Select SCEP Certificate Authority connection.

3. Fill in the Connection details:

   • Certificate Authority connection name: A friendly name, such as Keytos Shield Static SCEP.
   • Service account: The email address of the connector service account you created in Step 3.
   • Pub/Sub topic: The full topic name, such as projects/<project-id>/topics/<topic-id>.
   • Certificate Authority connection configuration identifier: The exact ca_connection_config_id from your adapter_config.json, such as keytos-shield-static-scep.

4. Click Add.

   

Step 8 - How to Create the Certificate Provisioning Profile for Chromebooks

The certificate provisioning profile defines the certificate each Chromebook receives from Keytos Shield. Choose the type that fits how your Chromebooks are used:

• User certificate: Issued to each user after they sign in, with the user’s Google email in the certificate. Choose this when Chromebooks are assigned to people and you want to see who connected.
• Device certificate: Issued to the Chromebook itself, with its serial number in the certificate. Choose this for shared, kiosk, or classroom Chromebooks, or when devices need Wi-Fi on the sign-in screen before anyone signs in.

You can create both. Use the same type in this step and in Step 9.

• User Certificate
• Device Certificate

Step 9 - How to Push an EAP-TLS Wi-Fi Network to Chromebooks in Google Admin

Now create the Wi-Fi network that uses the certificate and trusts your Shield Root CA. Follow the tab that matches the certificate type you chose in Step 8.

• User Certificate
• Device Certificate

Google Admin pushes the Wi-Fi network and certificate profile to the users or Chromebooks in the organizational unit you selected. Your Chromebooks request a certificate from Keytos Shield, and they connect automatically once your Shield access policy allows them (Step 10).

Step 10 - How to Create a RADIUS Access Policy for Chromebook Certificates in Keytos Shield

Keytos Shield checks every connection against the access policies in your network profile, in priority order. Chromebook users and devices live in Google Workspace, not Entra ID, so a policy that matches certificates against Entra ID objects rejects them. Create an access policy that only runs the default certificate check: Shield accepts any valid, unrevoked certificate issued by your Shield CAs, without looking anything up in Entra ID.

1. In Keytos Shield, select Network profiles from the left-hand menu, and expand the network profile for the SSID your Chromebooks join.

2. Scroll to Access Policies, and click Add Access Policy.

   

3. In the new policy, enter a Policy Name, such as Chromebook Certificates.

4. Leave Enable Password Authentication unchecked. Chromebooks authenticate with their certificate, so there’s no reason to allow passwords on this policy.

5. Leave Match With Entra ID Objects unchecked. This is what keeps Shield from looking up the certificate’s user or device in Entra ID.

   

6. (optional) Under VLAN Assignment, choose a VLAN for your Chromebooks.

7. Click Save Network Profile.

Learn more about access policies, priorities, and VLANs in our network profile guide.

How to Test and Verify Chromebook Certificate-Based Wi-Fi Authentication

1. Start a managed Chromebook in the organizational unit you configured. For user certificates, sign in with a user in that organizational unit. If the Chromebook was already running, open chrome://policy and click Reload policies.
2. Open chrome://certificate-manager and check Your certificates. Within a few minutes, a certificate issued by your Keytos Shield CA appears, named after the user’s email (user certificate) or the device serial number (device certificate).
3. Open Settings > Network > Wi-Fi. The Chromebook connects to your SSID automatically.
4. In Keytos Shield, open Certificate logs to see the request (Cert Location Type shows SCEP), and Network logs to see the successful authentication.

How to Troubleshoot Chromebook Certificate Provisioning with GCCC

• The Chromebook never receives a certificate: Check the Application event log on the connector server for GoogleCloudCertificateConnector errors. Make sure the subscription in adapter_config.json matches your topic’s subscription, and that cert-provisioning-api-pubsub-publisher@system.gserviceaccount.com has Pub/Sub Publisher on the topic.
• The connector service stops right after starting: The event log shows Cannot parse configurations when adapter_config.json is missing or isn’t valid JSON, or when adapter_key.json isn’t in the installation folder.
• Keytos Shield rejects the request: Make sure challenge.txt contains only your current static SCEP password, with no extra spaces or line breaks. If you rotate the password in Shield, update the file and restart the service.
• The certificate is installed but Wi-Fi doesn’t connect: Make sure the SSID matches your Shield network profile, the Server Certificate Authority is your Shield Root CA, and your Shield access policy allows the certificate. For more help, see our RADIUS troubleshooting guide.

Frequently Asked Questions (FAQ) About Keytos Shield and Chromebooks

Does Keytos Shield Support Chromebooks?

Yes. Keytos Shield issues certificates to Chromebooks managed in Google Workspace through the Google Cloud Certificate Connector and static SCEP, and authenticates them with EAP-TLS. An Entra ID tenant is only required for management of your Keytos Shield subscription.

Why Can’t I Use the Secure SCEP Profile in Google Admin?

Google no longer supports Secure SCEP profiles for Chromebooks. Chromebooks now use Certificate Authority connections and Certificate provisioning profiles, which is the setup this guide walks you through.

Should I Use User Certificates or Device Certificates for Chromebooks?

It depends on how your Chromebooks are used. User certificates identify the person and only work after sign-in. Device certificates identify the Chromebook and connect on the sign-in screen, which suits shared, kiosk, and classroom devices. You can deploy both. Follow the User Certificate or Device Certificate tab in Step 8 and Step 9.

Next Steps - How to Connect Your Other Devices to Keytos Shield

Now that your Chromebooks are connecting with certificates, you can push network profiles to the rest of your fleet.

🚀 Distribute Network Profiles to Other Devices View Certificate Logs