Add ChromeOS Wi-Fi enrollment via ACME Device Attestation - #546
Draft
llewis1234 wants to merge 8 commits into
Draft
Add ChromeOS Wi-Fi enrollment via ACME Device Attestation#546llewis1234 wants to merge 8 commits into
llewis1234 wants to merge 8 commits into
Conversation
Documents issuing mTLS-capable device identity certificates to ChromeOS devices enrolled via Google Workspace, distinct from the short-lived attestation certificate issued automatically on enrollment.
Extracted from an earlier, unmerged draft (PR-A). Adds the missing prerequisite the device identity certificates tutorial's "extension deployed" step assumed but this guide never actually covered: enabling the Verified Access API, granting the verifiedaccess OAuth scope, Verified Access Mode, and installing/force-configuring the extension itself. The canonical extension update URL is left flagged inline (unresolved from the earlier draft) rather than guessed.
The Wi-Fi enrollment content lives in protect-wireless-networks.mdx's new ChromeOS section, not a standalone page. Point both references there instead.
The troubleshooting section referenced required policies and cert verification without pointing to where they're actually configured or explained, now that both exist.
Matches the link style convention used elsewhere in the repo, including the docs/chromeos-wifi-enrollment branch.
Matches the sentence-case convention used by this file's other numbered step headings.
|
|
3 tasks
Adds a ChromeOS subsection to the MDM-managed clients list in the wireless networks tutorial, covering RADIUS and EAP-TLS Wi-Fi config through Google Admin. Consolidates the browser cert guide's separate Wi-Fi auto-selection subsection into this new section so the two don't drift out of sync.
Both files live in tutorials/, so use ./protect-wireless-networks.mdx like other same-directory cross-links in this repo, instead of the functionally-equivalent but inconsistent ../tutorials/ form.
llewis1234
force-pushed
the
docs/chromeos-wifi-enrollment
branch
from
August 1, 2026 07:37
d79ea11 to
0b3c143
Compare
hslatman
reviewed
Aug 2, 2026
Comment on lines
+800
to
+801
| using ACME Device Attestation against Google's Chrome Verified Access API — not through an MDM profile push, | ||
| and not through Smallstep's Wi-Fi or credential resources described above. |
Member
There was a problem hiding this comment.
— not through an MDM profile push, and not through Smallstep's Wi-Fi or credential resources described above. can be removed.
|
|
||
| <Alert severity="info" mb={4}> | ||
| <div> | ||
| Skip Step 1 (credential) and the Wi-Fi resource created at the top of Step 3 for ChromeOS. Neither applies here: the client certificate comes from Certificate Manager directly, and the Wi-Fi network profile is delivered by Google Admin rather than by Smallstep. |
Member
There was a problem hiding this comment.
Eventually we'll want these resources to still be created, so that the ChromeOS agent can get a full configuration, with more use cases automatically handled. We'll have to ensure that we have docs on root distribution for all use cases configured for ChromeOS.
|
|
||
| If it doesn't connect: | ||
|
|
||
| - **No RADIUS traffic at all** — the device never associated. This is always a client-side certificate selection failure; recheck the issuer pattern above, not the network or access point. |
Member
There was a problem hiding this comment.
Or no cert issued at all, which can have a few causes.
| If it doesn't connect: | ||
|
|
||
| - **No RADIUS traffic at all** — the device never associated. This is always a client-side certificate selection failure; recheck the issuer pattern above, not the network or access point. | ||
| - **`unknown CA` / `unable to get local issuer certificate`** — the RADIUS server's trust store is missing the issuing authority's root or intermediate. |
Member
There was a problem hiding this comment.
I believe just the root is sufficient. The ChromeOS EAP-TLS handshake includes the client intermediate.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Blocked on #545 — this branch is stacked on top of it, so the diff below currently includes #545's changes too. Once #545 merges, this diff will automatically collapse down to just this PR's own changes and it'll be ready for review. Opening now as a draft so it's visible and trackable rather than sitting only in my fork.
Test plan
valerun against changed files (noise-filtered against house style — no unaddressed findings)markdown-link-checkrun against changed files — all internal/external links resolve once Add ChromeOS device identity certificates tutorial #545 is merged🤖 Generated with Claude Code