Home Device Management Deploying KyberGate on Chromebooks

Deploying KyberGate on Chromebooks

Last updated on Jul 10, 2026

Deploying KyberGate on Chromebooks

This guide walks through deploying KyberGate to managed Chromebooks using the Google Admin Console. It's a three-part setup:

  1. Chrome extension — filtering, SafeSearch, activity logging, and the in-browser block page
  2. Root CA certificate — so HTTPS content inspection is trusted
  3. Proxy (PAC) — routes traffic through KyberGate for full filtering

Do all three for complete filtering. Start with a test OU containing one or two Chromebooks before rolling out school-wide.

Before You Begin

  • You need Super Admin (or delegated Chrome management) in Google Admin
  • You need your KyberGate Organization ID — find it under Settings → Workspace → Setup in your dashboard, or on Devices → Add Device → Chromebook
  • Put your test Chromebooks in a dedicated test OU so changes don't affect students

Part 1: Force-Install the KyberGate Chrome Extension

  1. Go to admin.google.com → Devices → Chrome → Apps & extensions
  2. Select the OU for your test/student Chromebooks
  3. Click the + button → Add from Chrome Web Store
  4. Search for KyberGate, or paste the extension ID: aodjgiobchlnlmicciieahkfnmkoojef
  5. Set the Installation policy to Force install (not "Available" or "Allowed"). You may also pin it to the toolbar so you can confirm it's active during testing.
  6. Click Save

Set the Extension's Organization ID (Required)

The extension needs to know which organization it belongs to. Without this, it won't know which policies to apply or where to report.

  1. In the same Apps & extensions screen, click the KyberGate extension in the list
  2. Scroll to Policy for extensions
  3. Paste this JSON, replacing YOUR_ORG_ID with your Organization ID:
{
  "orgId": { "Value": "YOUR_ORG_ID" }
}
  1. Click Save

Tip: For fully managed student devices, you can also set "allowUnenroll": { "Value": false } to prevent students from disconnecting the extension.

Part 2: Upload the Root CA Certificate

This lets KyberGate inspect HTTPS traffic without certificate warnings.

  1. Download the Root CA certificate: https://proxy.kybergate.com/api/ca.pem
  2. In Google Admin, go to Devices → Networks → Certificates
  3. Click Create Certificate and upload the ca.pem file you downloaded
  4. Name it KyberGate Root CA
  5. In the Certificate Authority section, check "Enabled for Chromebook", then click Add
    • (This is Google's current equivalent of the older "Use as an HTTPS certificate authority" option. If you don't enable it for Chromebook, HTTPS sites will show certificate errors instead of filtering correctly.)
  6. Save

Part 3: Configure the Proxy (PAC URL)

  1. Go to admin.google.com → Devices → Networks → Wi-Fi (or Ethernet)
  2. Edit the network configuration used by your student OU
  3. Under Proxy settings, select Automatic proxy configuration
  4. Set the PAC URL to (replace YOUR_ORG_ID):
https://proxy.kybergate.com/api/pac/YOUR_ORG_ID?email=${user_email}

The ${user_email} variable lets KyberGate identify the signed-in student automatically, so per-user policies and reporting work. 5. Save the network configuration

Part 4: Verify

  1. Grab a Chromebook in the test OU and restart it (or run chrome://policy → Reload policies to speed up propagation — changes can take 10–15 minutes)
  2. Sign in as a test user
  3. Confirm the KyberGate extension icon appears in the Chrome toolbar
  4. Click the icon — it should show "Active — Filtering Enabled"
  5. Visit a blocked site (e.g. tiktok.com) — you should see the KyberGate block page
  6. Visit an allowed site (e.g. khanacademy.org) — it should load normally
  7. Run a Google search — results should be locked to SafeSearch
  8. Check Devices in your dashboard — the Chromebook should appear, with the signed-in user's name once it syncs

Troubleshooting

Extension doesn't appear on the Chromebook

  • Confirm it's added to the correct OU and set to Force install
  • Wait 10–15 minutes, then restart Chrome or the device
  • On the device: chrome://policy → Reload policies; chrome://extensions → confirm KyberGate is present and enabled
  • See Chrome Extension Troubleshooting

Extension shows "Disconnected" or "Not Configured"

  • The Org ID managed config is missing or wrong — recheck the JSON in Part 1
  • Confirm the device is enrolled and appears in your dashboard

Blocked sites still load / HTTPS certificate errors

  • Confirm the Root CA is uploaded and "Enabled for Chromebook" is checked (Part 2)
  • Confirm the PAC URL is set on the student OU's network (Part 3)
  • See Certificate Installation Issues and HTTPS Sites Not Being Filtered

Device name shows "Managed Chromebook" instead of the student

  • This is normal until the signed-in user syncs. Once the user signs in and your roster is synced (Google Workspace), the device shows the user's name. Connect your roster under Settings → Workspace.

Students bypassing the filter

  • Set allowUnenroll to false in the extension config, and ensure the proxy PAC is enforced at the network level. See Students Bypassing the Filter.

Recommended: Connect Google Workspace

For per-student policies and automatic device-to-user matching, connect your directory under Settings → Workspace and choose which OUs to sync. See Google Workspace Integration.

Need a hand? Open the live chat in your dashboard (bottom-right) — it goes to a real person on our team.