Cloud Managed Networks

The usual culprit on ChromeOS is how the extension got onto the box. Chrome only lets an extension write to the certificate store when it's force-installed through the Google Admin console (Devices, Chrome, Apps and extensions) on an enrolled, managed Chromebook. If someone added the Onboard extension from the Web Store by hand, everything looks right, the profile lands, and the cert install silently does nothing. That's a ChromeOS platform restriction, not an Aruba one.

So two checks: is the device enterprise-enrolled in your Workspace domain, and is the extension on the force-install list? Then open chrome://certificate-manager and see whether the cert is really missing or just not being picked. If it's there but Wi-Fi won't use it, set the issuer pattern in the Wi-Fi policy you push so ChromeOS auto-selects it, and remember the EAP identity comes from that policy's Username field, not from the cert.

Yup, device is provisioned and enrolled. Force Install + Pin is the setting. 

Powerwashed the chromebook and the app gets installed and pinned. Go through the workflow, sign in and it provisions but no certificate gets installed. 

not too sure what else to check here 

The usual culprit on ChromeOS is how the extension got onto the box. Chrome only lets an extension write to the certificate store when it's force-installed through the Google Admin console (Devices, Chrome, Apps and extensions) on an enrolled, managed Chromebook. If someone added the Onboard extension from the Web Store by hand, everything looks right, the profile lands, and the cert install silently does nothing. That's a ChromeOS platform restriction, not an Aruba one.

So two checks: is the device enterprise-enrolled in your Workspace domain, and is the extension on the force-install list? Then open chrome://certificate-manager and see whether the cert is really missing or just not being picked. If it's there but Wi-Fi won't use it, set the issuer pattern in the Wi-Fi policy you push so ChromeOS auto-selects it, and remember the EAP identity comes from that policy's Username field, not from the cert.

The usual culprit on ChromeOS is how the extension got onto the box. Chrome only lets an extension write to the certificate store when it's force-installed through the Google Admin console (Devices, Chrome, Apps and extensions) on an enrolled, managed Chromebook. If someone added the Onboard extension from the Web Store by hand, everything looks right, the profile lands, and the cert install silently does nothing. That's a ChromeOS platform restriction, not an Aruba one.

So two checks: is the device enterprise-enrolled in your Workspace domain, and is the extension on the force-install list? Then open chrome://certificate-manager and see whether the cert is really missing or just not being picked. If it's there but Wi-Fi won't use it, set the issuer pattern in the Wi-Fi policy you push so ChromeOS auto-selects it, and remember the EAP identity comes from that policy's Username field, not from the cert.

------------------------------
Dustin Burns

@Worldcom Exchange, Inc.


If my post was useful accept solution and/or give kudos
------------------------------

Any particular reason I don't see this extension? The Aruba onboard app is installed as android app not an extension. It is not in the extensions store through the workspace admin portal but is on the play store

so when i open chrome://extensions, I don't see Onboard there. 

------------------------------
Aruba Partner Ambassador ACP-CA, Campus Architect, Clearpass
------------------------------


Original Message:
Sent: Aug 12, 2026 05:41 PM
From: DB86
Subject: Chromebook Aruba App onboarding using Central NAC w/ Google workspace - cert not installing?

The usual culprit on ChromeOS is how the extension got onto the box. Chrome only lets an extension write to the certificate store when it's force-installed through the Google Admin console (Devices, Chrome, Apps and extensions) on an enrolled, managed Chromebook. If someone added the Onboard extension from the Web Store by hand, everything looks right, the profile lands, and the cert install silently does nothing. That's a ChromeOS platform restriction, not an Aruba one.

So two checks: is the device enterprise-enrolled in your Workspace domain, and is the extension on the force-install list? Then open chrome://certificate-manager and see whether the cert is really missing or just not being picked. If it's there but Wi-Fi won't use it, set the issuer pattern in the Wi-Fi policy you push so ChromeOS auto-selects it, and remember the EAP identity comes from that policy's Username field, not from the cert.

------------------------------
Dustin Burns

@Worldcom Exchange, Inc.


If my post was useful accept solution and/or give kudos
------------------------------

That one's on me: the force-install extension path is how ClearPass Onboard does ChromeOS, and I reached for it out of habit. For Central NAC you're on the documented path, the Central docs really do send ChromeOS users to the Play Store app, so you're not doing it wrong.

That changes where to look. The Android app runs in ChromeOS's Android container, so first check which side the cert landed on: Android Settings, Security, Credential storage on the Chromebook versus chrome://certificate-manager on the ChromeOS side. If it's sitting in the Android keystore but never made it to ChromeOS, that handoff is the break. Two things gate that handoff: the docs list the app as compatible with ChromeOS 115 and later, so confirm your build, and the app should be admin-deployed through the Workspace Play settings on managed devices rather than user-installed. If the version checks out and the cert is stranded on the Android side, that's a clean TAC case with the app logs.

Any particular reason I don't see this extension? The Aruba onboard app is installed as android app not an extension. It is not in the extensions store through the workspace admin portal but is on the play store

so when i open chrome://extensions, I don't see Onboard there. 

------------------------------
Aruba Partner Ambassador ACP-CA, Campus Architect, Clearpass
------------------------------



Original Message:
Sent: Aug 12, 2026 05:41 PM
From: DB86
Subject: Chromebook Aruba App onboarding using Central NAC w/ Google workspace - cert not installing?

The usual culprit on ChromeOS is how the extension got onto the box. Chrome only lets an extension write to the certificate store when it's force-installed through the Google Admin console (Devices, Chrome, Apps and extensions) on an enrolled, managed Chromebook. If someone added the Onboard extension from the Web Store by hand, everything looks right, the profile lands, and the cert install silently does nothing. That's a ChromeOS platform restriction, not an Aruba one.

So two checks: is the device enterprise-enrolled in your Workspace domain, and is the extension on the force-install list? Then open chrome://certificate-manager and see whether the cert is really missing or just not being picked. If it's there but Wi-Fi won't use it, set the issuer pattern in the Wi-Fi policy you push so ChromeOS auto-selects it, and remember the EAP identity comes from that policy's Username field, not from the cert.

------------------------------
Dustin Burns

@Worldcom Exchange, Inc.


If my post was useful accept solution and/or give kudos
------------------------------

------------------------------
Aruba Partner Ambassador ACP-CA, Campus Architect, Clearpass
------------------------------


Original Message:
Sent: Aug 13, 2026 07:05 PM
From: DB86
Subject: Chromebook Aruba App onboarding using Central NAC w/ Google workspace - cert not installing?

That one's on me: the force-install extension path is how ClearPass Onboard does ChromeOS, and I reached for it out of habit. For Central NAC you're on the documented path, the Central docs really do send ChromeOS users to the Play Store app, so you're not doing it wrong.

That changes where to look. The Android app runs in ChromeOS's Android container, so first check which side the cert landed on: Android Settings, Security, Credential storage on the Chromebook versus chrome://certificate-manager on the ChromeOS side. If it's sitting in the Android keystore but never made it to ChromeOS, that handoff is the break. Two things gate that handoff: the docs list the app as compatible with ChromeOS 115 and later, so confirm your build, and the app should be admin-deployed through the Workspace Play settings on managed devices rather than user-installed. If the version checks out and the cert is stranded on the Android side, that's a clean TAC case with the app logs.

------------------------------
Dustin Burns

@Worldcom Exchange, Inc.


If my post was useful accept solution and/or give kudos
------------------------------



Original Message:
Sent: Aug 13, 2026 01:44 PM
From: PM-90050b
Subject: Chromebook Aruba App onboarding using Central NAC w/ Google workspace - cert not installing?

Any particular reason I don't see this extension? The Aruba onboard app is installed as android app not an extension. It is not in the extensions store through the workspace admin portal but is on the play store

so when i open chrome://extensions, I don't see Onboard there. 

------------------------------
Aruba Partner Ambassador ACP-CA, Campus Architect, Clearpass
------------------------------




Original Message:
Sent: Aug 12, 2026 05:41 PM
From: DB86
Subject: Chromebook Aruba App onboarding using Central NAC w/ Google workspace - cert not installing?

The usual culprit on ChromeOS is how the extension got onto the box. Chrome only lets an extension write to the certificate store when it's force-installed through the Google Admin console (Devices, Chrome, Apps and extensions) on an enrolled, managed Chromebook. If someone added the Onboard extension from the Web Store by hand, everything looks right, the profile lands, and the cert install silently does nothing. That's a ChromeOS platform restriction, not an Aruba one.

So two checks: is the device enterprise-enrolled in your Workspace domain, and is the extension on the force-install list? Then open chrome://certificate-manager and see whether the cert is really missing or just not being picked. If it's there but Wi-Fi won't use it, set the issuer pattern in the Wi-Fi policy you push so ChromeOS auto-selects it, and remember the EAP identity comes from that policy's Username field, not from the cert.

------------------------------
Dustin Burns

@Worldcom Exchange, Inc.


If my post was useful accept solution and/or give kudos
------------------------------

OK not quite sure I understand but this is what I did.

I onboarded my windows laptop, looked at the Root CA and user cert that was installed. 
Exported the Root CA

On the google admin portal, I uploaded manually the Aruba private root CA, I can confirm it showed up on the Chromebook in the credential store - Trusted Credentials - User
I then proceeded to modify the Wi-Fi network profile like you mentioned for the following settings 

Username: ${LOGIN_EMAIL}
Server Certificate Authority -> Set to Aruba Private Root CA
Issuer Pattern: ->> Cloud Authentication Private Root CA (powered by HPE Aruba)

Save, then tried again to connect and it worked...

So somehow the APP does not have the rights to write the root ca to the credential store....

This isn't smooth. Will open a tac case. 

------------------------------
Aruba Partner Ambassador ACP-CA, Campus Architect, Clearpass
------------------------------


Original Message:
Sent: Aug 14, 2026 08:35 AM
From: PM-90050b
Subject: Chromebook Aruba App onboarding using Central NAC w/ Google workspace - cert not installing?

------------------------------
Aruba Partner Ambassador ACP-CA, Campus Architect, Clearpass
------------------------------



Original Message:
Sent: Aug 13, 2026 07:05 PM
From: DB86
Subject: Chromebook Aruba App onboarding using Central NAC w/ Google workspace - cert not installing?

That one's on me: the force-install extension path is how ClearPass Onboard does ChromeOS, and I reached for it out of habit. For Central NAC you're on the documented path, the Central docs really do send ChromeOS users to the Play Store app, so you're not doing it wrong.

That changes where to look. The Android app runs in ChromeOS's Android container, so first check which side the cert landed on: Android Settings, Security, Credential storage on the Chromebook versus chrome://certificate-manager on the ChromeOS side. If it's sitting in the Android keystore but never made it to ChromeOS, that handoff is the break. Two things gate that handoff: the docs list the app as compatible with ChromeOS 115 and later, so confirm your build, and the app should be admin-deployed through the Workspace Play settings on managed devices rather than user-installed. If the version checks out and the cert is stranded on the Android side, that's a clean TAC case with the app logs.

------------------------------
Dustin Burns

@Worldcom Exchange, Inc.


If my post was useful accept solution and/or give kudos
------------------------------




Original Message:
Sent: Aug 13, 2026 01:44 PM
From: PM-90050b
Subject: Chromebook Aruba App onboarding using Central NAC w/ Google workspace - cert not installing?

Any particular reason I don't see this extension? The Aruba onboard app is installed as android app not an extension. It is not in the extensions store through the workspace admin portal but is on the play store

so when i open chrome://extensions, I don't see Onboard there. 

------------------------------
Aruba Partner Ambassador ACP-CA, Campus Architect, Clearpass
------------------------------





Original Message:
Sent: Aug 12, 2026 05:41 PM
From: DB86
Subject: Chromebook Aruba App onboarding using Central NAC w/ Google workspace - cert not installing?

The usual culprit on ChromeOS is how the extension got onto the box. Chrome only lets an extension write to the certificate store when it's force-installed through the Google Admin console (Devices, Chrome, Apps and extensions) on an enrolled, managed Chromebook. If someone added the Onboard extension from the Web Store by hand, everything looks right, the profile lands, and the cert install silently does nothing. That's a ChromeOS platform restriction, not an Aruba one.

So two checks: is the device enterprise-enrolled in your Workspace domain, and is the extension on the force-install list? Then open chrome://certificate-manager and see whether the cert is really missing or just not being picked. If it's there but Wi-Fi won't use it, set the issuer pattern in the Wi-Fi policy you push so ChromeOS auto-selects it, and remember the EAP identity comes from that policy's Username field, not from the cert.

------------------------------
Dustin Burns

@Worldcom Exchange, Inc.


If my post was useful accept solution and/or give kudos
------------------------------

That's the right diagnosis, and nice work closing it. What your Windows export proved is that the Android container has no path into the ChromeOS trusted credential store. Apps inside the container keep their certs in the Android keystore, ChromeOS Wi-Fi never looks there, and the trusted root store only takes CAs from device policy or a manual import. Platform restriction, not a misconfig, which is exactly why the app kept reporting success while your store stayed empty.

Your workaround is also the clean production design, not just a patch: root CA pushed from Google Admin, identity from the login variable, server CA pinned, issuer pattern set so the right cert gets picked automatically. That's device management doing the trust work and the app carrying only the half it can actually deliver.

Definitely open the TAC case anyway. This deserves to be a documented limitation with an enhancement behind it, and cases are how that happens.

------------------------------
Dustin Burns

@Worldcom Exchange, Inc.


If my post was useful accept solution and/or give kudos
------------------------------


Original Message:
Sent: Aug 18, 2026 01:36 PM
From: PM-90050b
Subject: Chromebook Aruba App onboarding using Central NAC w/ Google workspace - cert not installing?

OK not quite sure I understand but this is what I did.

I onboarded my windows laptop, looked at the Root CA and user cert that was installed. 
Exported the Root CA

On the google admin portal, I uploaded manually the Aruba private root CA, I can confirm it showed up on the Chromebook in the credential store - Trusted Credentials - User
I then proceeded to modify the Wi-Fi network profile like you mentioned for the following settings 

Username: ${LOGIN_EMAIL}
Server Certificate Authority -> Set to Aruba Private Root CA
Issuer Pattern: ->> Cloud Authentication Private Root CA (powered by HPE Aruba)

Save, then tried again to connect and it worked...

So somehow the APP does not have the rights to write the root ca to the credential store....

This isn't smooth. Will open a tac case. 

------------------------------
Aruba Partner Ambassador ACP-CA, Campus Architect, Clearpass
------------------------------



Original Message:
Sent: Aug 14, 2026 08:35 AM
From: PM-90050b
Subject: Chromebook Aruba App onboarding using Central NAC w/ Google workspace - cert not installing?

------------------------------
Aruba Partner Ambassador ACP-CA, Campus Architect, Clearpass
------------------------------




Original Message:
Sent: Aug 13, 2026 07:05 PM
From: DB86
Subject: Chromebook Aruba App onboarding using Central NAC w/ Google workspace - cert not installing?

That one's on me: the force-install extension path is how ClearPass Onboard does ChromeOS, and I reached for it out of habit. For Central NAC you're on the documented path, the Central docs really do send ChromeOS users to the Play Store app, so you're not doing it wrong.

That changes where to look. The Android app runs in ChromeOS's Android container, so first check which side the cert landed on: Android Settings, Security, Credential storage on the Chromebook versus chrome://certificate-manager on the ChromeOS side. If it's sitting in the Android keystore but never made it to ChromeOS, that handoff is the break. Two things gate that handoff: the docs list the app as compatible with ChromeOS 115 and later, so confirm your build, and the app should be admin-deployed through the Workspace Play settings on managed devices rather than user-installed. If the version checks out and the cert is stranded on the Android side, that's a clean TAC case with the app logs.

------------------------------
Dustin Burns

@Worldcom Exchange, Inc.


If my post was useful accept solution and/or give kudos
------------------------------





Original Message:
Sent: Aug 13, 2026 01:44 PM
From: PM-90050b
Subject: Chromebook Aruba App onboarding using Central NAC w/ Google workspace - cert not installing?

Any particular reason I don't see this extension? The Aruba onboard app is installed as android app not an extension. It is not in the extensions store through the workspace admin portal but is on the play store

so when i open chrome://extensions, I don't see Onboard there. 

------------------------------
Aruba Partner Ambassador ACP-CA, Campus Architect, Clearpass
------------------------------






Original Message:
Sent: Aug 12, 2026 05:41 PM
From: DB86
Subject: Chromebook Aruba App onboarding using Central NAC w/ Google workspace - cert not installing?

The usual culprit on ChromeOS is how the extension got onto the box. Chrome only lets an extension write to the certificate store when it's force-installed through the Google Admin console (Devices, Chrome, Apps and extensions) on an enrolled, managed Chromebook. If someone added the Onboard extension from the Web Store by hand, everything looks right, the profile lands, and the cert install silently does nothing. That's a ChromeOS platform restriction, not an Aruba one.

So two checks: is the device enterprise-enrolled in your Workspace domain, and is the extension on the force-install list? Then open chrome://certificate-manager and see whether the cert is really missing or just not being picked. If it's there but Wi-Fi won't use it, set the issuer pattern in the Wi-Fi policy you push so ChromeOS auto-selects it, and remember the EAP identity comes from that policy's Username field, not from the cert.

------------------------------
Dustin Burns

@Worldcom Exchange, Inc.


If my post was useful accept solution and/or give kudos
------------------------------

The thing that irks me is the root ca having to be extracted and uploaded which means we need to keep track of its expiry date vs the user keeping the app and it renewing itself 

WIll open a case, will post back here the outcome. 

EDIT: Now it seems the user store is locked down and the app can no longer push the user cert. The server cert (root ca) is there, the identity gets detected properly but no user credentials get pushed. 

------------------------------
Aruba Partner Ambassador ACP-CA, Campus Architect, Clearpass
------------------------------


Original Message:
Sent: Aug 18, 2026 03:22 PM
From: DB86
Subject: Chromebook Aruba App onboarding using Central NAC w/ Google workspace - cert not installing?

That's the right diagnosis, and nice work closing it. What your Windows export proved is that the Android container has no path into the ChromeOS trusted credential store. Apps inside the container keep their certs in the Android keystore, ChromeOS Wi-Fi never looks there, and the trusted root store only takes CAs from device policy or a manual import. Platform restriction, not a misconfig, which is exactly why the app kept reporting success while your store stayed empty.

Your workaround is also the clean production design, not just a patch: root CA pushed from Google Admin, identity from the login variable, server CA pinned, issuer pattern set so the right cert gets picked automatically. That's device management doing the trust work and the app carrying only the half it can actually deliver.

Definitely open the TAC case anyway. This deserves to be a documented limitation with an enhancement behind it, and cases are how that happens.

------------------------------
Dustin Burns

@Worldcom Exchange, Inc.


If my post was useful accept solution and/or give kudos
------------------------------



Original Message:
Sent: Aug 18, 2026 01:36 PM
From: PM-90050b
Subject: Chromebook Aruba App onboarding using Central NAC w/ Google workspace - cert not installing?

OK not quite sure I understand but this is what I did.

I onboarded my windows laptop, looked at the Root CA and user cert that was installed. 
Exported the Root CA

On the google admin portal, I uploaded manually the Aruba private root CA, I can confirm it showed up on the Chromebook in the credential store - Trusted Credentials - User
I then proceeded to modify the Wi-Fi network profile like you mentioned for the following settings 

Username: ${LOGIN_EMAIL}
Server Certificate Authority -> Set to Aruba Private Root CA
Issuer Pattern: ->> Cloud Authentication Private Root CA (powered by HPE Aruba)

Save, then tried again to connect and it worked...

So somehow the APP does not have the rights to write the root ca to the credential store....

This isn't smooth. Will open a tac case. 

------------------------------
Aruba Partner Ambassador ACP-CA, Campus Architect, Clearpass
------------------------------




Original Message:
Sent: Aug 14, 2026 08:35 AM
From: PM-90050b
Subject: Chromebook Aruba App onboarding using Central NAC w/ Google workspace - cert not installing?

------------------------------
Aruba Partner Ambassador ACP-CA, Campus Architect, Clearpass
------------------------------





Original Message:
Sent: Aug 13, 2026 07:05 PM
From: DB86
Subject: Chromebook Aruba App onboarding using Central NAC w/ Google workspace - cert not installing?

That one's on me: the force-install extension path is how ClearPass Onboard does ChromeOS, and I reached for it out of habit. For Central NAC you're on the documented path, the Central docs really do send ChromeOS users to the Play Store app, so you're not doing it wrong.

That changes where to look. The Android app runs in ChromeOS's Android container, so first check which side the cert landed on: Android Settings, Security, Credential storage on the Chromebook versus chrome://certificate-manager on the ChromeOS side. If it's sitting in the Android keystore but never made it to ChromeOS, that handoff is the break. Two things gate that handoff: the docs list the app as compatible with ChromeOS 115 and later, so confirm your build, and the app should be admin-deployed through the Workspace Play settings on managed devices rather than user-installed. If the version checks out and the cert is stranded on the Android side, that's a clean TAC case with the app logs.

------------------------------
Dustin Burns

@Worldcom Exchange, Inc.


If my post was useful accept solution and/or give kudos
------------------------------






Original Message:
Sent: Aug 13, 2026 01:44 PM
From: PM-90050b
Subject: Chromebook Aruba App onboarding using Central NAC w/ Google workspace - cert not installing?

Any particular reason I don't see this extension? The Aruba onboard app is installed as android app not an extension. It is not in the extensions store through the workspace admin portal but is on the play store

so when i open chrome://extensions, I don't see Onboard there. 

------------------------------
Aruba Partner Ambassador ACP-CA, Campus Architect, Clearpass
------------------------------







Original Message:
Sent: Aug 12, 2026 05:41 PM
From: DB86
Subject: Chromebook Aruba App onboarding using Central NAC w/ Google workspace - cert not installing?

The usual culprit on ChromeOS is how the extension got onto the box. Chrome only lets an extension write to the certificate store when it's force-installed through the Google Admin console (Devices, Chrome, Apps and extensions) on an enrolled, managed Chromebook. If someone added the Onboard extension from the Web Store by hand, everything looks right, the profile lands, and the cert install silently does nothing. That's a ChromeOS platform restriction, not an Aruba one.

So two checks: is the device enterprise-enrolled in your Workspace domain, and is the extension on the force-install list? Then open chrome://certificate-manager and see whether the cert is really missing or just not being picked. If it's there but Wi-Fi won't use it, set the issuer pattern in the Wi-Fi policy you push so ChromeOS auto-selects it, and remember the EAP identity comes from that policy's Username field, not from the cert.

------------------------------
Dustin Burns

@Worldcom Exchange, Inc.


If my post was useful accept solution and/or give kudos
------------------------------

Fair concern, but the tracking burden is smaller than it looks. The manual object is only the trust anchor, and root CAs are built to be boring, they change on the order of years, not certificate cycles. The user certs keep renewing through the app exactly as before, so the automation you actually care about survives. Practical guardrail: open the CA in Google Admin, note the expiry, and set a reminder a couple of months ahead in whatever drives your renewal calendar. One date to track versus a fleet that self-renews is a decent trade.

And yes, post the case outcome here. That limitation deserves the paper trail.

The thing that irks me is the root ca having to be extracted and uploaded which means we need to keep track of its expiry date vs the user keeping the app and it renewing itself 

WIll open a case, will post back here the outcome. 

EDIT: Now it seems the user store is locked down and the app can no longer push the user cert. The server cert (root ca) is there, the identity gets detected properly but no user credentials get pushed. 

------------------------------
Aruba Partner Ambassador ACP-CA, Campus Architect, Clearpass
------------------------------



Original Message:
Sent: Aug 18, 2026 03:22 PM
From: DB86
Subject: Chromebook Aruba App onboarding using Central NAC w/ Google workspace - cert not installing?

That's the right diagnosis, and nice work closing it. What your Windows export proved is that the Android container has no path into the ChromeOS trusted credential store. Apps inside the container keep their certs in the Android keystore, ChromeOS Wi-Fi never looks there, and the trusted root store only takes CAs from device policy or a manual import. Platform restriction, not a misconfig, which is exactly why the app kept reporting success while your store stayed empty.

Your workaround is also the clean production design, not just a patch: root CA pushed from Google Admin, identity from the login variable, server CA pinned, issuer pattern set so the right cert gets picked automatically. That's device management doing the trust work and the app carrying only the half it can actually deliver.

Definitely open the TAC case anyway. This deserves to be a documented limitation with an enhancement behind it, and cases are how that happens.

------------------------------
Dustin Burns

@Worldcom Exchange, Inc.


If my post was useful accept solution and/or give kudos
------------------------------




Original Message:
Sent: Aug 18, 2026 01:36 PM
From: PM-90050b
Subject: Chromebook Aruba App onboarding using Central NAC w/ Google workspace - cert not installing?

OK not quite sure I understand but this is what I did.

I onboarded my windows laptop, looked at the Root CA and user cert that was installed. 
Exported the Root CA

On the google admin portal, I uploaded manually the Aruba private root CA, I can confirm it showed up on the Chromebook in the credential store - Trusted Credentials - User
I then proceeded to modify the Wi-Fi network profile like you mentioned for the following settings 

Username: ${LOGIN_EMAIL}
Server Certificate Authority -> Set to Aruba Private Root CA
Issuer Pattern: ->> Cloud Authentication Private Root CA (powered by HPE Aruba)

Save, then tried again to connect and it worked...

So somehow the APP does not have the rights to write the root ca to the credential store....

This isn't smooth. Will open a tac case. 

------------------------------
Aruba Partner Ambassador ACP-CA, Campus Architect, Clearpass
------------------------------





Original Message:
Sent: Aug 14, 2026 08:35 AM
From: PM-90050b
Subject: Chromebook Aruba App onboarding using Central NAC w/ Google workspace - cert not installing?

------------------------------
Aruba Partner Ambassador ACP-CA, Campus Architect, Clearpass
------------------------------






Original Message:
Sent: Aug 13, 2026 07:05 PM
From: DB86
Subject: Chromebook Aruba App onboarding using Central NAC w/ Google workspace - cert not installing?

That one's on me: the force-install extension path is how ClearPass Onboard does ChromeOS, and I reached for it out of habit. For Central NAC you're on the documented path, the Central docs really do send ChromeOS users to the Play Store app, so you're not doing it wrong.

That changes where to look. The Android app runs in ChromeOS's Android container, so first check which side the cert landed on: Android Settings, Security, Credential storage on the Chromebook versus chrome://certificate-manager on the ChromeOS side. If it's sitting in the Android keystore but never made it to ChromeOS, that handoff is the break. Two things gate that handoff: the docs list the app as compatible with ChromeOS 115 and later, so confirm your build, and the app should be admin-deployed through the Workspace Play settings on managed devices rather than user-installed. If the version checks out and the cert is stranded on the Android side, that's a clean TAC case with the app logs.

------------------------------
Dustin Burns

@Worldcom Exchange, Inc.


If my post was useful accept solution and/or give kudos
------------------------------







Original Message:
Sent: Aug 13, 2026 01:44 PM
From: PM-90050b
Subject: Chromebook Aruba App onboarding using Central NAC w/ Google workspace - cert not installing?

Any particular reason I don't see this extension? The Aruba onboard app is installed as android app not an extension. It is not in the extensions store through the workspace admin portal but is on the play store

so when i open chrome://extensions, I don't see Onboard there. 

------------------------------
Aruba Partner Ambassador ACP-CA, Campus Architect, Clearpass
------------------------------








Original Message:
Sent: Aug 12, 2026 05:41 PM
From: DB86
Subject: Chromebook Aruba App onboarding using Central NAC w/ Google workspace - cert not installing?

The usual culprit on ChromeOS is how the extension got onto the box. Chrome only lets an extension write to the certificate store when it's force-installed through the Google Admin console (Devices, Chrome, Apps and extensions) on an enrolled, managed Chromebook. If someone added the Onboard extension from the Web Store by hand, everything looks right, the profile lands, and the cert install silently does nothing. That's a ChromeOS platform restriction, not an Aruba one.

So two checks: is the device enterprise-enrolled in your Workspace domain, and is the extension on the force-install list? Then open chrome://certificate-manager and see whether the cert is really missing or just not being picked. If it's there but Wi-Fi won't use it, set the issuer pattern in the Wi-Fi policy you push so ChromeOS auto-selects it, and remember the EAP identity comes from that policy's Username field, not from the cert.

------------------------------
Dustin Burns

@Worldcom Exchange, Inc.


If my post was useful accept solution and/or give kudos
------------------------------