Installing the Root CA Certificate

Installing the Root CA certificate enables browsers to trust the DNS Filtering block page when a blocked HTTPS site is accessed. Because DNS Filtering relies on redirecting requests for blocked domains, the browser would normally detect a certificate mismatch and display a security warning. 

By installing and trusting the Root CA, the browser can validate the block page response, allowing it to render properly instead of being blocked by certificate errors. This results in a consistent and user-friendly experience where end users see the intended block notification rather than a browser security warning.

Certificate Installation Behavior

When deploying the DNS Filtering Agent, the Root CA certificate is typically installed automatically as part of the setup process.

However, this step may not complete successfully in all environments. If users continue to see browser security warnings after installing the agent, it usually indicates that the certificate was not installed or is not trusted on the device.

In these cases, you should proceed with the manual installation steps below and verify certificate trust. For more details on how the agent configures DNS and certificate behavior, see: DNS Filtering Agent Behavior

Manual Installation

Step 1: Download the Root Certificate

Download the root certificate from CyberFOX: 👉 https://cdn.passwordboss.com/dns-client/rootCA.cer

Step 2: Install the Certificate

   sudo update-ca-certificates

Step 3: Verify

Visit a blocked HTTPS site. If the certificate is installed correctly, the CyberFOX DNS Filtering Block Page should appear instead of a browser warning.

Deploy using a PowerShell Script.

Using your RMM tools, you can download the Root Root certificate and deploy it automatically using this PowerShell script as an administrator. 

# Copyright (c) 2026 CyberFOX LLC
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are met:
#    * Redistributions of source code must retain the above copyright
#      notice, this list of conditions and the following disclaimer.
#    * Redistributions in binary form must reproduce the above copyright
#      notice, this list of conditions and the following disclaimer in the
#      documentation and/or other materials provided with the distribution.
#    * Neither the name of the AutoElevate nor the names of its contributors
#      may be used to endorse or promote products derived from this software
#      without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
# DISCLAIMED. IN NO EVENT SHALL CYBERFOX BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA,
# OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
# LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

<#
Installs the Root Certificate for CyberFOX DNS Filtering to reduce errors on block pages. REQUIRES ADMIN RIGHTS TO DEPLOY 
 #>

# Download the Certificate from the source location  
$Uri = "https://cdn.passwordboss.com/dns-client/rootCA.cer"
$Tmp = Join-Path $env:TEMP "rootCA.cer"
Invoke-WebRequest -Uri $Uri -UseBasicParsing -OutFile $Tmp

# Validate thumbprint
$Expected = "6AC54D30EE60A4A95D709D805D7A0DA12ED6E03D".ToUpper()
$Actual   = (Get-PfxCertificate $Tmp).Thumbprint.ToUpper()
if ($Actual -ne $Expected) { throw "Thumbprint mismatch: expected $Expected, got $Actual" }

# Import to machine root store (requires admin)
Import-Certificate -FilePath $Tmp -CertStoreLocation "Cert:\LocalMachine\Root"

# Verify
Get-ChildItem Cert:\LocalMachine\Root |
  Where-Object Thumbprint -eq $Expected |
  Select-Object Subject, Thumbprint

Get-ChildItem Cert:\LocalMachine\Root |
  Where-Object Thumbprint -eq "6AC54D30EE60A4A95D709D805D7A0DA12ED6E03D" |

# Copyright (c) 2026 CyberFOX LLC
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are met:
#    * Redistributions of source code must retain the above copyright
#      notice, this list of conditions and the following disclaimer.
#    * Redistributions in binary form must reproduce the above copyright
#      notice, this list of conditions and the following disclaimer in the
#      documentation and/or other materials provided with the distribution.
#    * Neither the name of the AutoElevate nor the names of its contributors
#      may be used to endorse or promote products derived from this software
#      without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
# DISCLAIMED. IN NO EVENT SHALL CYBERFOX BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA,
# OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
# LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

<#
Removes the Root Certificate for CyberFOX DNS Filtering. REQUIRES ADMIN RIGHTS TO DEPLOY 
 #>
 
$thumb = "6AC54D30EE60A4A95D709D805D7A0DA12ED6E03D".ToUpper()
$store = New-Object System.Security.Cryptography.X509Certificates.X509Store("Root","LocalMachine")
$store.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::ReadWrite)
$cert = $store.Certificates | Where-Object { $_.Thumbprint.ToUpper() -eq $thumb }
if ($cert) { $store.Remove($cert); "Removed: $($cert.Subject) [$thumb]" } else { "Not found" }
$store.Close()