SurfProtect Setup

Created: July 22, 2025

Author: Samia

Edited: February 27, 2026

Introduction

SurfProtect’s cloud-based HTTPS filtering feature requires that all devices on your network trust Exa. This document provides guidance to enable this across your network, however, should you require any additional help then please do not hesitate to contact our dedicated Support Team on 0345 145 1234 or by emailing support

Certificate Setup

A certificate published by Exa needs to be installed on each device within your network. This can be done on a per machine basis, however we have detailed how to deploy the necessary certificate using various management tools below.

Note: for all customers using our connectivity, we recommend setting your DNS forwarders to:82.219.4.28 & 82.219.4.29

Download your SurfProtect Certificate
Once you are logged into your active directory server, go to Start > Administrative Tools > Group Policy Management
Identify the Group Policy Object that you wish to edit (optionally, you may wish to create a new Group Policy Object to define all SurfProtect settings in one place)
Right click the newly created Group Policy Object and select Edit
Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies
Right click on the folder Trusted Root Certification Authorities and select Import
Follow the steps in the Certificate Import Wizard , providing the location of the certificate downloaded from the SurfProtect panel when prompted for a file to import

Download your SurfProtect Certificate
Log into the admin panel at admin.google.com
Navigate to Device Management
In the DEVICE SETTINGS menu on the left, select Network
Select Certificate > ADD CERTIFICATE
Ensure that the option labelled Use this certificate as an HTTPS certificate authority is checked
Click Save

Download your SurfProtect Certificate
Click the Windows Start Button and type ‘mmc’ into the search bar to locate and run the Microsoft Management Console
Navigate to the File menu > Add/Remove Snap-in
From the Available Snap-ins pane, select Certificates and then click on the button labelled Add
In the Certificates Snap-in wizard, select Computer Account or Local Computer when prompted for which context the snap-in should manage certificate for
Click Finish to close the wizard and OK to close the snap-ins window
In the console tree, double-click on Certificates
Right-click the Trusted Root Certification Authorities and click Import
Follow the steps in the Certificate Import Wizard, providing the location of the certificate downloaded from the SurfProtect panel when prompted for a file to import

Download your SurfProtect Certificate
Launch Keychain Access
From the Keychain Access toolbar, select File > Import Items
Provide the location of the downloaded certificate when prompted for a file location and click Open
Double-click on the newly imported certificate, labelled Exa Networks Ltd CA
In the Trust section of the newly opened window, set the value in the dropdown labelled Secure Sockets Layer (SSL) to Always Trust
Close the current window to apply changes
Enter your system password when prompted and click on Update Settings

Download your SurfProtect Certificate
Tap Allow on the pop-up
On the following screen tap Install (if using iOS 12.x, you can find this in Settings > Profile Downloaded)
Input your Passcode if prompted
Confirm by tapping Install
Return to Settings and follow: General > About > Certificate Trust Settings and Enable ‘Exa Networks Ltd Root CA’ by tapping the slider

Download your SurfProtect Certificate
Open the Chrome Browser
Go to Settings
Click Privacy and Security on the left hand side menu
Click Security in the middle
Scroll down to Manage Certificates
Ensure you click Authorities, then Import

Download your SurfProtect Certificate
Open Device settings
Go to Security (or Biometrics and Security)
Go to Other Security Settings
Go to Install From Storage or Install a Certificate (depending on devices)
Select CA Certificate from the list of types available
Accept a warning alert
Navigate to the certificate file on the device and click Open to confirm the certificate install

Legacy Individual Machine Installation

Download your SurfProtect Quantum Certificate
This will prompt a download, click Open
Input your Passcode when prompted
Set the certificate name then choose credential use as VPN and Apps option
Tap OK, this will then install and become a user certificate

Download your SurfProtect Quantum Certificate
Scroll to the bottom of your Chromebook’s Settings page and click on Show Advanced Settings
Under the HTTPS/SSL section, click on Manage Certificates
Navigate to the Authorities tab in the Certificate Manager and click Import
Select the certificate from your Downloads location and click on Open