Deploy KyberGate on Chromebooks

Go to admin.google.com and sign in with your super admin account. Navigate to Devices → Chrome → Apps & extensions.

You can also access this at: admin.google.com/ac/chrome/apps/user

In the left panel, select the OU that contains your student Chromebooks. You can apply to the entire domain or specific OUs (e.g., 'Students', 'Grade 6-8').

Tip: Start with a small test OU before rolling out to the entire school.

Click the + icon → 'Add from Chrome Web Store'. Search for 'KyberGate' or enter the extension ID directly. Select it and click 'Add'.

Extension ID: aodjgiobchlnlmicciieahkfnmkoojef

Click on the KyberGate extension in the list. Under 'Installation Policy', select 'Force install'. This silently installs the extension on all Chromebooks in the selected OU — students cannot remove it.

Force install + pin to toolbar is recommended so students can see the protection status.

Under 'Policy for extensions', paste the JSON configuration from your KyberGate dashboard. This sets your org ID and proxy URL so the extension connects to your account automatically.

Go to Devices → Networks → Certificates. Click 'Create Certificate', upload the KyberGate Root CA (.pem file), and in the Certificate Authority section check 'Enabled for Chromebook' (Google's current equivalent of the older 'Use as an HTTPS certificate authority' option), then click Add. This allows Chrome OS to trust KyberGate's SSL inspection certificates.

Download the Root CA from: proxy.kybergate.com/api/ca.pem

Go to Devices → Networks → Wi-Fi (or Ethernet). Edit your network profile and under Proxy settings, select 'Automatic proxy configuration'. Enter your PAC URL from the KyberGate dashboard. This routes Chromebook traffic through KyberGate for full SSL inspection and the 8-layer detection engine.

PAC URL format: https://proxy.kybergate.com/api/pac/YOUR_ORG_ID

Open a managed Chromebook and check that the KyberGate extension icon appears in the toolbar. Open the popup to verify it shows 'Connected' with your org name. Visit a blocked site (e.g. tiktok.com) to confirm the KyberGate block page appears. In the KyberGate dashboard, the device should appear under Devices within 60 seconds.

Copy this into the "Policy for extensions" field. Replace YOUR_ORG_ID with the Organization ID shown on your KyberGate dashboard under Settings (the Settings page prints this exact snippet pre-filled). Only orgId is required; deviceName and allowUnenroll are optional and are the only other keys the extension reads.

{
  "orgId": {
    "Value": "YOUR_ORG_ID"
  },
  "deviceName": {
    "Value": "Lab-Cart-1"
  },
  "allowUnenroll": {
    "Value": false
  }
}

The Root CA certificate allows Chrome OS to trust KyberGate's SSL inspection. Without it, students will see certificate warnings.

1. Download the Root CA: kybergate-root-ca.pem
2. In Google Admin, go to Devices → Networks → Certificates
3. Click "Add Certificate" and upload the .pem file
4. Name it "KyberGate Root CA"
5. In the Certificate Authority section, check "Enabled for Chromebook" (Google's current equivalent of the older "Use as an HTTPS certificate authority" option)
6. Click Save

Apply the certificate to the same OU as the extension for consistent coverage.

The PAC (Proxy Auto-Configuration) file routes Chromebook web traffic through KyberGate's inspection proxy for full SSL content analysis.

1. In Google Admin, go to Devices → Networks
2. Select or create a Wi-Fi or Ethernet network configuration for your Chromebooks
3. Under Proxy settings, select "Automatic proxy configuration"
4. Enter your PAC URL (replace YOUR_ORG_ID with your org ID from the KyberGate dashboard):

https://proxy.kybergate.com/api/pac/YOUR_ORG_ID

Find your Organization ID in the KyberGate dashboard under Settings → School Info.

Open a managed Chromebook and verify: (1) the KyberGate extension icon appears in the toolbar and shows "Connected", (2) visit a blocked site like tiktok.com to confirm the KyberGate block page appears, and (3) check the KyberGate dashboard — the device should appear under Devices within 60 seconds.