• Overview
• Who should import these certificates
• Download the certificates
• Verify a download before importing
• Add the chain to the ChatGPT pin list
• Certificate renewal

Overview

When Cloud Secure Edge (CSE) inspects internet traffic, it decrypts the HTTPS connection at the Secure Web Gateway (SWG), inspects it, and re-encrypts it with a certificate issued by CSE’s own certificate authority (CA). A device only accepts that re-issued certificate if it trusts the CSE SWG CA chain.

The CSE desktop app installs the SWG CA chain into the device’s local certificate store automatically. Browsers and most applications read that store, so they keep working with no administrator action.

Some applications do not rely on the device certificate store alone. They ship their own list of trusted CAs, or they check the server’s certificate against a built-in list, which is called certificate pinning. On those apps, inspected traffic fails to connect until an administrator adds the CSE SWG CA chain to what the app will accept, using that app’s own managed-device controls.

The app that needs this today is the ChatGPT desktop app. If you find another app that fails to connect once TLS decryption is on, contact your account team so it can be added here.

Importing this chain is what lets inspection capabilities such as Require approved accounts work on certificate-pinning apps instead of breaking connectivity.

Who should import these certificates

Import these certificates only on devices managed by an organization that uses CSE Internet Threat Protection (ITP) with TLS decryption turned on. Installing them tells the device to trust traffic inspected by CSE’s Secure Web Gateway. There is no reason to install them on a device outside such an organization.

Download the certificates

Import both certificates. Some applications accept the intermediate alone, but the full chain is the supported configuration.

The subject name on these certificates still reads Banyan Security, Inc., which was the company name before the SonicWall acquisition. This is expected. Certificate names cannot be changed without reissuing the chain, so the name you see in your application will not match the file name.

Verify a download before importing

Each certificate below lists its SHA-256 fingerprint, which is a unique identity code for that exact file. Check it before you import, so that you know you received the genuine certificate and not a substituted one. Run the following command and compare the output with the value listed here.

openssl x509 -in cse-swg-root-ca.crt -noout -subject -enddate -fingerprint -sha256

Expected values for the root CA:

subject=C=US, ST=CA, L=San Francisco, street=142 Minna St, postalCode=94103, O=Banyan Security, Inc., CN=Banyan SWG Root CA
notAfter=Oct  3 22:23:19 2033 GMT
sha256 Fingerprint=7D:41:5A:9F:6E:B8:4E:64:AE:71:88:EE:68:E7:5F:4F:57:6D:A4:FB:6D:52:99:A2:F7:4E:F3:B7:C9:7D:D7:F4

Expected values for the intermediate CA:

subject=C=US, ST=CA, L=San Francisco, street=142 Minna St, postalCode=94103, O=Banyan Security, Inc., CN=Banyan SWG Prod Intermediate Root CA
notAfter=Dec  5 22:07:29 2028 GMT
sha256 Fingerprint=AD:DD:1F:A0:67:52:DA:06:E4:B2:F1:26:34:98:24:FE:CD:E2:75:AD:BB:68:80:66:D2:6E:B0:1F:D7:0D:6C:E3

Add the chain to the ChatGPT pin list

The ChatGPT desktop and mobile apps do not read the device certificate store for this. They check the server’s certificate against a built-in list, called the pin list, after the normal certificate checks have already passed. Adding your certificate to the device therefore does nothing on its own. The certificate has to be added to the app’s pin list, and that exception has to be delivered to the device by your mobile device management (MDM) system.

OpenAI documents this as Step 6 of Corporate network controls in ChatGPT Enterprise, under Consider ChatGPT desktop and mobile application compatibility. In OpenAI’s words, you add your own certificates to the pin list and distribute them to clients through MDM. That section links a detailed instruction document; follow it, and supply the two certificate files above as your own certificates.

Two things follow from this that are worth planning around:

• The device has to be enrolled in an MDM system. There is no way for a user, or for an administrator working device by device, to make this change in the app. An unmanaged device running the ChatGPT desktop app cannot be brought under TLS inspection.
• The same requirement covers the mobile apps. OpenAI states that the iOS, macOS, and Android ChatGPT apps all pin certificates.

Note: Do this before you turn on a capability that depends on TLS decryption for users who run the ChatGPT desktop app. Until the pin list exception is in place, the app cannot reach its service at all. See Require Approved Accounts for AI Apps.

Certificate renewal

The intermediate CA expires before the root CA, in December 2028. When CSE reissues it, devices running the CSE desktop app pick up the replacement automatically. Anywhere an administrator trusted the certificate by hand, the new file has to be supplied the same way.