For organizations using relying heavily on Google in their environments, Google’s Certificate Authority Service seems like an obvious choice for deploying certificate-based authentication. However, certificate authorities can be challenging to set up and configure properly. What’s more, certificate-based authentication should be backed by an authentication server such as a RADIUS server for the utmost security.

SecureW2 provides everything organizations need to implement certificate-driven security. Aside from the knowledgeable support team you can rely on for smooth deployment, we provide a powerful Cloud RADIUS server designed for passwordless authentication. Get everything you need in one spot to deploy certificates, including the expertise.

Many organizations see the benefits of going passwordless but think that they can reduce the cost of doing so by building their own Public Key Infrastructure. Unfortunately, this often ends up being a costlier venture in terms of finances and time spent. Building a private PKI requires expertise, space for the servers, and regular maintenance. Additionally, certificate lifecycle management - from issuance to renewal to building a certificate revocation list - is time-consuming.

Cloud-based and managed solutions like our JoinNow Connector PKI can save you the resources you would otherwise spend on building and maintaining your own. What’s more, since our PKI infrastructure is cloud-based, your administrators can access it from anywhere without having to replicate it at every office location and it integrates seamlessly with cloud infrastructure like Okta.

Yes. In fact, our PKI service is the industry’s first solution to provide a unique Chromebook extension for this exact purpose.

Because managed Chromebooks are unable to download applications easily, we’ve developed an extension instead. End users can simply download and run the extension on their Chromebooks to configure their devices and enroll for certificates.

For devices that aren’t managed Chromebooks, we have gateway APIs that can integrate with all major MDMs, including Google Workspace. Certificates are then issued through these gateways using the Simple Certificate Enrollment Protocol (SCEP).

From the end-user’s perspective, there’s nothing they need to do. The enrollment process is completely automated, requiring no user input.

With Jamf and Intune, we even offer an advanced integration feature called auto-revocation. Every several minutes, our PKI service will check your MDM’s smart and static groups. Devices added to these groups will have their certificates revoked automatically.

For unmanaged devices and BYODs, our cloud service offers JoinNow MultiOS, which is a dissolvable self-service onboarding application. From start to finish, it only takes seconds to configure devices and enroll users for certificates.

Users start by navigating to the customizable onboarding page and entering in their Google cloud credentials (or their credentials from your SAML Identity Provider). SecureW2 then confirms in your Google cloud that the user is authorized for a certificate through SAML authentication.

As long as the user is authorized, MultiOS then runs, configuring their device with the proper Wi-Fi profiles and enrolling them for a certificate.

Our PKI allows you to create a private certificate authority only. However, you can create as many private certificate authorities as you need. Our customers commonly build a different certificate authority for different groups of people to enable role-based access control, such as having a separate certificate authority for their HR and DevOps teams. This makes managing certificates for different roles organized and efficient.

Public key cryptography requires the use of both public and private keys. While the public key can be sent freely, the private key must be stored securely, and we take key storage seriously as a result. The best way to guarantee your private key won’t be removed from your device is to ensure it is stored in the proper key stores and enclaves and set to non-exportable. To increase security further, we recommend that keys are stored in a device’s Trusted Platform Module (TPM) instead of storing the keys in software.