Prisma Access Browser
Certificate-Based Enforcement
Table of Contents
Certificate-Based Enforcement
Ensure that access to Certificate-enabled applications is only possible from the Prisma Access Browser
| Where Can I Use This? | What Do I Need? |
|---|---|
|
|
Google Workspace Certificate Enforcement
Prisma Access comes with a dedicated Public Key Infrastructure (PKI)
used for enforcement. Once enabled, each browser is provisioned with a
dedicated, unique client certificate issued by the PKI (each tenant has a unique
root CA used to sign the client certificates). Certificate enforcement ensures
login to the identity provider is only allowed when the client certificate
signed by the dedicated root CA is provided.
You need to set up the
following prerequisites before configuring this option:
- Google Workspace Context-Aware Access feature, available for Enterprise or Education accounts, or with Cloud Identity Premium.
- Setting up SSO Authentication fto Prisma Access with Group.
- Obtain the Prisma Access Browser Access root Certificate
- Go to the Prisma Access Browser Management Console and select Administration > Integration.
- Select and Enable Google Workspace Integration.
- In the first section, click Prisma Access Certificate to download the unique tenant root certificate.
Add the Prisma Access Browser Certificate to Google Workspace- Go to Google Admin Console > Devices > Networks.
- Click on Certificates, then Add Certificate and upload the Prisma Access certificate.
- Check the Endpoint Verification option and click Add.
Add the Prisma Access Browser Certificate to Google Workspace- Go to Google Admin Console -> Security -> Access and data control -> Context-Aware Access.
- Make sure that Turn On is selected.
- Click Access levels, then select Create new access level.
- Enter a Name for the Access Level. We recommend that you call it Prisma Access Browsers.
- Click the Advanced tab and paste the text found at the end of
section 2 on the instructions on the page. The following is
sample
text.device.certificates.exists(cert,cert.is_valid && cert.root_ca_fingerprint =="3HiBH90JUEGvo6kwGJxbkfKeD7pQAcqTzQLbCGH+t0s")Assign the New Access Level to Apps
- Go to Google Admin Console -> Security -> Access and data control -> Context-Aware Access.
- Click Assign access levels.
- Select one or more apps from the list and click Assign.
- Check the newly-created Prisma Access Browsers access level (the name that you created in step 2, above).
Validation- Install the Prisma Access Browser.
- Wait while the new Google Workspace configuration occurs; this usually takes approximately 5 minutes.
- Perform a successful sign-in to an assigned app from Prisma Access Browser. Attempt to sign -in to the same application from a different browser. It shouldn't succeed.
