For ChromeOS and Chrome Enterprise Core devices to work on a domain with TLS inspection (also known as SSL inspection), some hostnames need to be exempt from inspection. This is because certificates can only be imported at the user level and are only honored for user-level traffic. Some device-level traffic doesn’t use the TLS or SSL certificate to protect users against certain kinds of security risks.
Updates to the hostname allowlist
- Dec 19, 2024: Changed http://www.play.googleapis.com/generate_204 to http://play.googleapis.com/generate_204
Expand the list to view previous updates.
Previous updates
Hostname allowlist for all ChromeOS and Chrome Enterprise Core devices
To ensure that devices work with TLS inspection or networks restricting external traffic, you need to allow the following hostnames on your proxy server. For details on how to allow hostnames, check with your network administrator.
Additional hosts to allow
You need to allow the additional hostnames for TLS inspection to work correctly if you're using:
- Chrome extensions or apps from the Chrome Web Store on devices, including single-app kiosk devices.
- Android apps from the Google Play Store on devices