Installing SSL/TLS Certificates to Display Block Pages on HTTPS Websites

Updated at December 10th, 2025

+ More

Table of Contents

Agent Installs Certificate Automatically Manually install the Root Certificate Step 1: Download the Root Certificate Step 2: Install the Certificate Step 4: Verify Deploy the Root Certificate using a PowerShell Script. Create the Trusted certificate and deploy using Intune. Troubleshooting Common Issues ❌ Browser Warning: “Your connection is not private” ❌ Certificate Not Trusted ❌ Block Page Not Displaying ❌ Still Seeing the .pem Extension

This article explains how to install a root SSL/TLS certificate to enable CyberFOX’s Block Page on HTTPS-based websites. While content will still be blocked without this certificate, installing it ensures users see a branded block page instead of a browser error.

Installing the SSL Certificate is optional, but recommended for a seamless user experience.

Agent Installs Certificate Automatically

If you deploy the DNS Filtering Agent, the CyberFOX Root Certificate will be automatically installed during agent installation.

Manually install the Root Certificate

For deployments not using an agent, you can manually install the SSL certificate by following the steps below:

Step 1: Download the Root Certificate

Download the root certificate from CyberFOX: 👉 https://cdn.passwordboss.com/dns-client/rootCA.pem

Step 2: Install the Certificate

On Windows

Double-click CyberFOXrootCA.cer.
Click Install Certificate.
Choose Local Machine and click Next.
Select Place all certificates in the following store.
Browse to Trusted Root Certification Authorities.
Click Next, then Finish.

On macOS

Open CyberFOXrootCA.cer with Keychain Access.
Drag it into the System keychain.
Double-click the certificate, expand Trust, and set When using this certificate to Always Trust.
Close and authenticate to save.

On Linux

Copy the file to /usr/local/share/ca-certificates/.
Run:

   sudo update-ca-certificates

Step 4: Verify

Visit a blocked HTTPS site. If the certificate is installed correctly, the CyberFOX DNS Filtering Block Page should appear instead of a browser warning.

Deploy the Root Certificate using a PowerShell Script.

Using your RMM tools, you can download the Root Root certificate and deploy it automatically using this PowerShell script as an administrator.

# Copyright (c) 2025 Password Boss
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are met:
#    * Redistributions of source code must retain the above copyright
#      notice, this list of conditions and the following disclaimer.
#    * Redistributions in binary form must reproduce the above copyright
#      notice, this list of conditions and the following disclaimer in the
#      documentation and/or other materials provided with the distribution.
#    * Neither the name of the AutoElevate nor the names of its contributors
#      may be used to endorse or promote products derived from this software
#      without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
# DISCLAIMED. IN NO EVENT SHALL OPENDNS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA,
# OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
# LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

<#
Installs the Root Certificate for CyberFOX DNS Filtering to reduce errors on block pages. REQUIRES ADMIN RIGHTS TO DEPLOY 
 #>

# Download the Certificate from the source location  
$Uri = "https://cdn.passwordboss.com/dns-client/rootCA.pem"
$Tmp = Join-Path $env:TEMP "rootCA.pem"
Invoke-WebRequest -Uri $Uri -UseBasicParsing -OutFile $Tmp

# Validate thumbprint
$Expected = "6AC54D30EE60A4A95D709D805D7A0DA12ED6E03D".ToUpper()
$Actual   = (Get-PfxCertificate $Tmp).Thumbprint.ToUpper()
if ($Actual -ne $Expected) { throw "Thumbprint mismatch: expected $Expected, got $Actual" }

# Import to machine root store (requires admin)
Import-Certificate -FilePath $Tmp -CertStoreLocation "Cert:\LocalMachine\Root"

# Verify
Get-ChildItem Cert:\LocalMachine\Root |
  Where-Object Thumbprint -eq $Expected |
  Select-Object Subject, Thumbprint

You can verify the installation of the Certificate with this command:


Get-ChildItem Cert:\LocalMachine\Root |
  Where-Object Thumbprint -eq "6AC54D30EE60A4A95D709D805D7A0DA12ED6E03D" |

If you need to remove the Root Certificate, deploy the following script:

# Copyright (c) 2025 Password Boss
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are met:
#    * Redistributions of source code must retain the above copyright
#      notice, this list of conditions and the following disclaimer.
#    * Redistributions in binary form must reproduce the above copyright
#      notice, this list of conditions and the following disclaimer in the
#      documentation and/or other materials provided with the distribution.
#    * Neither the name of the AutoElevate nor the names of its contributors
#      may be used to endorse or promote products derived from this software
#      without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
# DISCLAIMED. IN NO EVENT SHALL OPENDNS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA,
# OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
# LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

<#
Removes the Root Certificate for CyberFOX DNS Filtering. REQUIRES ADMIN RIGHTS TO DEPLOY 
 #>
 
$thumb = "6AC54D30EE60A4A95D709D805D7A0DA12ED6E03D".ToUpper()
$store = New-Object System.Security.Cryptography.X509Certificates.X509Store("Root","LocalMachine")
$store.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::ReadWrite)
$cert = $store.Certificates | Where-Object { $_.Thumbprint.ToUpper() -eq $thumb }
if ($cert) { $store.Remove($cert); "Removed: $($cert.Subject) [$thumb]" } else { "Not found" }
$store.Close()

Create the Trusted certificate and deploy using Intune.

Admin Center: https://intune.microsoft.com
Devices → Windows → Configuration profiles → Create profile
Platform: Windows 10 and later
1. Profile type: Templates → Trusted certificate
Basics
1. Name: Trusted Root CA – CyberFOX DNS
2. Description: Deploy CyberFOX DNS Root CA (thumbprint 6AC5...E03D) to Computer\Root
Configuration settings
1. Trusted certificate: Upload the rootCA.cer certificate
2. Destination store: Computer certificate store – Root
Scope tags (optional): apply your RBAC tags.
Assignments
1. Include: your Windows device groups (e.g., All Windows Devices).
2. Exclude: any groups that should not receive the CA.
Review + Create

Why Computer\Root? It ensures system‑wide trust for services (VPN/Wi‑Fi/agents). Use User\Root only for very specific user‑scoped scenarios.

Troubleshooting Common Issues

❌ Browser Warning: “Your connection is not private”

Cause: The certificate may not be installed in the correct store.
Fix: Reinstall the certificate and ensure it’s placed in the Trusted Root Certification Authorities store (Windows) or System keychain (macOS).

❌ Certificate Not Trusted

Cause: The certificate may not be marked as trusted.
Fix: On macOS, open Keychain Access, double-click the certificate, and set Always Trust under the “Trust” section.

❌ Block Page Not Displaying

Cause: The certificate is missing or improperly installed.
Fix: Confirm the certificate is installed and trusted. Also, ensure that CyberFOX DNS Filtering is configured to display blocked pages.

❌ Still Seeing the .pem Extension

Cause: File extensions may be hidden by default.
Fix: Ensure the file is renamed to CyberFOXrootCA.cer and not CyberFOXrootCA.cer.pem.

filters dns certificates ssl https

Contact Us