Tag: firefox

How to Point Your Browser at CyBlock (Manual Settings and PAC File)

Applies to: CyBlock · Connecting browsers to your CyBlock web filter — manual settings for testing, PAC file via Group Policy for production.

CyBlock is a web filter that businesses use to control and monitor employee web access. To have a browser send its traffic through CyBlock, you point the browser at your CyBlock server using its connection settings. There are two ways to do this: for production, push CyBlock’s PAC file to all browsers using Group Policy (GPO) so every machine is configured automatically and stays consistent; for quick testing on a single machine, enter the connection settings manually in the browser.

Before you begin

You’ll need your CyBlock connection settings:

The server address and port for your CyBlock filter
Your PAC file URL (for PAC-based setup) — see Finding your PAC file URL below

Where to find your connection settings: These are specific to your deployment. Find the server address and port in the product under Settings → Proxy. If you’re on the CyBlock Cloud service, use the connection details Wavecrest provided when your account was set up. If you can’t locate them, contact us at 321-953-5351 or support@wavecrest.net.

Finding your PAC file URL

Your PAC file URL is available in CyBlock at:

Settings → Proxy → PAC File

Use this URL wherever a PAC or automatic-configuration URL is required below.

Which method should I use?

Production → push the PAC file via Group Policy. It’s centrally managed, consistent across all machines, and updates everywhere when the PAC file changes.
Testing / a single machine → enter the connection settings manually in the browser.

Manual setup (for testing)

Google Chrome, Microsoft Edge, and Internet Explorer (Windows connection settings)

Chrome, Edge, and Internet Explorer all use the Windows system connection settings, so configuring them once covers all three. (Chrome’s and Edge’s own buttons simply open these Windows settings.)

Windows 10 / 11:

Open Settings → Network & Internet → Proxy.
To connect directly: under Manual proxy setup, turn on Use a proxy server and click Set up. Enter your CyBlock server address and port, then click Save.
To use the PAC file instead: under Automatic proxy setup, turn on Use setup script, enter your PAC file URL, then click Save.

Classic dialog (any Windows version):

Press Win + R, type inetcpl.cpl, and press Enter to open Internet Options.
On the Connections tab, click LAN settings.
To connect directly: check Use a proxy server for your LAN, enter your CyBlock server address and port, and clear the other checkboxes.
For the PAC file: check Use automatic configuration script and enter your PAC file URL in the Address field.
Click OK, then OK again.

Mozilla Firefox

Firefox keeps its own connection settings, separate from Windows.

Click the menu button (☰) and choose Settings.
In the General panel, scroll down to Network Settings and click Settings….
To connect directly: select Manual proxy configuration, enter your CyBlock server address in the HTTP Proxy field, enter your port, and check Also use this proxy for HTTPS.
For the PAC file: select Automatic proxy configuration URL and enter your PAC file URL.
Click OK.

To have Firefox follow the Windows setting instead, choose Use system proxy settings.

Pushing the PAC file via Group Policy (for production)

Use Group Policy to deploy the PAC file to all managed browsers automatically. The correct method depends on the browser.

Google Chrome and Microsoft Edge (ADMX policies)

Import the Chrome and/or Edge ADMX templates into your domain Central Store (if not already present).
In Group Policy Management, edit the GPO that targets your users or computers.
Go to Computer Configuration → Policies → Administrative Templates → Google → Google Chrome → Proxy server (for Edge: Microsoft Edge → Proxy server).
Enable Choose how to specify proxy server settings and set it to Use a .pac proxy script.
Enable URL to a proxy .pac file and enter your PAC file URL.
Apply the GPO. Clients pick it up on the next policy refresh, or immediately with gpupdate /force.

Windows connection settings / Internet Explorer (Group Policy Preferences)

For browsers that rely on the Windows system connection settings (Internet Explorer, and Chrome/Edge where their own ADMX policies aren’t used):

In Group Policy Management, edit your GPO.
Go to User Configuration → Preferences → Control Panel Settings → Internet Settings and create a new item for your Windows/IE version.
Enable the Use automatic configuration script option and enter your PAC file URL. Press F5 so the setting applies (it turns green).
Apply the GPO.

The exact controls vary by Windows version; if the Internet Settings preference doesn’t expose the auto-config field on your build, push the PAC URL by setting the AutoConfigURL value under HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings with a Registry preference instead.

Note on older documentation: Earlier guides configured this through Internet Explorer Maintenance (User Configuration → Windows Settings → Internet Explorer Maintenance → Automatic Browser Configuration). That method no longer applies — Microsoft removed Internet Explorer Maintenance for managing Windows 8 and later, and Internet Explorer was retired in June 2022. Use the ADMX or Internet Settings methods above.

Installing the Wavecrest Root Certificate on Client Machines for CyBlock SSL Inspection

Applies to: CyBlock (proxy SSL inspection) · Area: Settings → Proxy → SSL Inspection Where it happens: each end-user’s computer

Which certificate are you looking for? (There are three — this is #3)

They’re easy to confuse. The quick tell is whose machine the certificate goes on and what it’s for:

Console / UI certificate — installed on the server, so administrators reach the Cyfin/CyBlock admin console over validated HTTPS. See Installing Your Own SSL Certificate on the Cyfin/CyBlock Web Interface (Secure Interface).
Proxy SSL certificates (Settings → Proxy → SSL Certificates) — client-authentication certificates the CyBlock proxy uses internally during inspection. Advanced/optional; CyBlock proxy only.
Wavecrest root certificate on end-user machines — this article. Installed on every user’s computer so their browser trusts CyBlock’s inspected HTTPS connections and SSL inspection works without certificate errors.

If your users are getting certificate warnings on HTTPS sites after you turned on SSL inspection, you’re in the right place — this is #3.

Why this is required

When SSL inspection is enabled, the CyBlock proxy decrypts each user’s HTTPS connection and re-secures it using a certificate signed by the Wavecrest root certificate authority (CA). If a user’s computer doesn’t already trust that Wavecrest root, the browser treats every inspected HTTPS site as untrusted and shows a certificate warning.

Installing the Wavecrest root certificate into the machine’s Trusted Root Certification Authorities store (or the browser’s own store, for Firefox) makes those inspected connections validate cleanly — no warnings. This is why the manual lists “Install the Wavecrest Certificate” as a required step, and why it must be done on each client whose traffic you inspect.

Do this before you enable SSL inspection, so users never see the warning in the first place.

Step 1 — Download the Wavecrest certificate

The certificate is served by your CyBlock instance, so always get it from the in-product link rather than a hard-coded address:

In CyBlock, go to Settings → Proxy → SSL Inspection.
Click the “Click here to install the Wavecrest Certificate” link on that screen. It points to your instance’s certificate file (for cloud customers this is your region’s host; for on-prem/VM it’s your own CyBlock server).
Save the certificate file — nokeywavecrest.crt — somewhere you can reach it during install. You’ll distribute this same file to client machines.

If you can’t locate the link, Wavecrest Technical Support can provide it: support@wavecrest.net or (321) 953-5351, Ext. 4.

Step 2 — Install the certificate on client machines

Pick the method that matches how your users’ machines are managed. For a domain environment, the Active Directory / GPO method (below) installs to all machines at once and is the recommended approach.

Windows 10 / 11 — single machine (manual)

Copy nokeywavecrest.crt to the machine and double-click it, then click Install Certificate.
Choose Local Machine (installs for all users on that PC; requires admin) and click Next.
Select Place all certificates in the following store, click Browse, choose Trusted Root Certification Authorities, and click OK → Next → Finish.
Click Yes on the security warning to confirm the root install.

Google Chrome and Microsoft Edge on Windows use this system store, so no separate steps are needed for them. (Firefox is separate — see below.)

Windows — all domain machines via Active Directory (GPO)

On the domain controller, open Group Policy Management.
Edit the GPO you use for client machines (for example, Default Domain Policy).
Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Public Key Policies → Trusted Root Certification Authorities.
Right-click it, choose All Tasks → Import, and complete the wizard, selecting nokeywavecrest.crt and the Trusted Root Certification Authorities store.
Client machines pick up the certificate on their next Group Policy refresh.

macOS — single machine (Keychain Access)

Copy nokeywavecrest.crt to the Mac and double-click it to open Keychain Access.
Add it to the System keychain (requires an admin login) so it applies to all users.
In Keychain Access, find the Wavecrest certificate, double-click it, expand Trust, and set When using this certificate to Always Trust. Close the window and authenticate to save.

Safari and Chrome on macOS use the system keychain; Firefox does not (see below).

Firefox — any operating system (its own certificate store)

Firefox does not use the OS store, so it needs the certificate imported separately on each machine (or distributed via Firefox enterprise policy):

Open Firefox → Settings → Privacy & Security → Certificates → View Certificates.
On the Authorities tab, click Import and select nokeywavecrest.crt.
Check Trust this CA to identify websites, click OK, and close the dialog.

Step 3 — Verify

On a client where you installed the certificate, browse to an HTTPS site in a category you’ve set to Inspected.
Confirm the page loads with the padlock and no certificate warning.
(Optional) View the certificate details — the issuer chain should show Wavecrest as the signing authority, confirming the inspected connection is trusted.

Inspected traffic can then be viewed in the Real-Time Web Monitor and in audit reports.

Important notes

Install before enabling inspection. Turning on SSL inspection before the root certificate is on client machines is the most common cause of “certificate error on every site” reports.
Some applications may still error. Apps that don’t use the operating system’s certificate store (they ship their own trust list or use certificate pinning) can fail under SSL inspection even after the root is installed. If you hit this, contact Wavecrest Technical Support at support@wavecrest.net or (321) 953-5351, Ext. 4.
This is a per-client step. Every machine whose HTTPS traffic you inspect needs the root certificate. GPO (Windows) and Firefox enterprise policy scale this to many machines at once.
Not the console/interface certificate. Installing your own certificate to reach the CyBlock admin UI over HTTPS is a different task — see the Secure Interface article.