Overview
This document describes how to set up Rippling to distribute two items to macOS devices. The items are the F5 Workforce AI Security proxy auto-configuration (PAC) file URL and the root certificate authority (CA) certificate. For Windows devices, see Deploy to Windows with Rippling.
Supported platforms
macOS 10.15 (Catalina) and later
About this document
This document explains how to create the policy that distributes the proxy configuration and the root CA certificate. It doesn't cover other parts of the Rippling platform. It also doesn't cover how to enroll devices in Rippling.
Proxy auto-configuration file
Workforce AI Security distributes its proxy information in a PAC file. The PAC file has all the information needed to send only generative AI traffic to the Workforce AI Security proxy service. The device sends other traffic by its typical route. For a full explanation of how PAC files work and the available customization options, see Proxy auto-configuration files overview.
Workforce AI Security uses the PAC file to update the list of generative AI domains. Most operating systems and browsers request the PAC file every 1 through 2 hours. If a device can't get a new file, the device keeps using the current file.
Root certificate
Workforce AI Security needs certificate trust to intercept connections and apply policy. Other network security and secure access service edge (SASE) vendors work the same way. This policy applies to connections to generative AI websites. All devices that Workforce AI Security governs must trust the Workforce AI Security root CA certificate.
Configure Rippling for macOS devices
All configuration in this section takes place in the Rippling admin dashboard at https://app.rippling.com/dashboard. Unless otherwise stated, all instructions start from this URL.
You must use an Admin account, not an Employee account, to complete this configuration. To check the active account type, select the user avatar in the dashboard.
Prerequisites
You need the Workforce AI Security PAC file URL and root CA certificate for these steps. Get them from https://admin.surepath.ai:
In CONFIGURE, go to Organization.
Select the Integrations tab.
In the File Downloads section, download the SurePath AI Root CA Certificate with the CER option.
In the Proxy and Provider URLs section, copy the Workforce AI Security Proxy PAC URL with the copy icon.
Create the Rippling configuration that distributes the URL of the proxy auto-configuration file to macOS
Go to IT > Devices.
Select the Configurations tab.
Select the macOS library tab.
In the list, search or scroll to Global HTTP Proxy.
Select Create.
On the new page, enter these configuration values:
Enter a Configuration Name, such as
Workforce AI Security Proxy PAC URL.If you want to add a description, enter a Configuration description.
For Proxy Type, select Auto.
Leave the Proxy Username and Proxy Password blank.
For Proxy PAC URL, enter the URL that you copied in the prerequisites.
Leave all other options cleared.
Select Save & continue.
In the Deploy configuration modal, select Device.
Add the devices that receive this configuration.
Select Deploy.
Create the Rippling configuration that distributes the root certificate to macOS
Go to IT > Devices.
Select the Configurations tab.
Select the macOS library tab.
In the list, search or scroll to Certificate Root.
Select Create.
On the new page, enter the relevant configuration values:
Enter a Configuration Name, such as
SurePath AI Root CA Certificate.If you want to add a description, enter a Configuration description.
For Certificate Name, enter a label such as
SurePath AI Root CA Certificate.Drop or select the certificate that you downloaded in the prerequisites.
Select Save & continue.
In the Deploy configuration modal, select Device.
Add the devices that receive this configuration.
Select Deploy.
Verify the integration
After you complete the deployment, verify that the endpoint is integrated correctly. Use the Workforce AI Security Ready tool.