Enables managed Chromebook devices to obtain and install network authentication certificates from a ClearPass Onboard server, allowing enterprise Wi-Fi/network access without manual certificate management

1) Admin force-installs extension via Google Admin policy. 2) User navigates to ClearPass Onboard server portal page (mdps_status.php). 3) Server page sends OTP + version via postMessage. 4) Content script prompts user for permission to install network credentials. 5) Background generates a device UDID (persisted in chrome.storage). 6) Posts enrollment request with OTP and device info to ClearPass server. 7) Server returns EST enrollment config. 8) Extension generates RSA key pair using Chrome enterprise.platformKeys, creates CSR, and POSTs it to the EST server. 9) Server returns PKCS#7 certificate. 10) Extension imports certificate into the Chromebook's enterprise platform keystore.

Target users: Enterprise IT administrators managing Chromebook fleets / End users of managed Chromebook devices in enterprise environments

Cannot determine exactly how the user obtains the OTP (whether via authenticated portal login or admin-provisioned code)
forge.bundle.js is a large third-party crypto library (~859KB) that inflates the file count but contains only generic crypto utilities
The extension requires chrome.enterprise.platformKeys which is only available when force-installed by admin policy, so direct testing from web store is not possible

Monetization

No paid features detected

No evidence of payment gating, billing APIs, subscription checks, upgrade prompts, or premium feature tiers within the extension code. The 'pro', 'license', and 'upgrade' keyword hits are all false positives from forge.bundle.js (a third-party crypto library with generic JavaScript code patterns). ClearPass is a commercial HPE/Aruba product, but the extension itself does not gate any functionality behind payment.

Confidence: 90
Payment platform: --
Source: AI / High
Login required: Yes
Reason: The extension requires an OTP (one-time password) as part of its enrollment workflow. In the ClearPass Onboard flow, the user must first authenticate with the ClearPass Onboard server (destination service) to obtain an OTP. The content_script.js (line 15) checks for 'event.data.request.otp' and the background.js (line 171) sends the OTP to the server's enrollment endpoint. The extension itself has no login UI, but the core workflow depends on the user being authenticated with the destination ClearPass Onboard service to receive the OTP.

Permission risk

Medium-risk permissions

This estimate uses declared permissions and host permissions to assess access scope and sensitivity.

扩展能力较强：storage

Publisher

Aruba, a Hewlett Packard Enterprise company

Hewlett Packard Enterprise Development LP

Email: [email protected]
Phone: --
Address: WW Corporate Headquarters - Spring, TX - United States 1701 E Mossy Oaks Rd Spring, TX 77389 US

Public contact fields are shown above. Developer portfolio pages are available on paid accounts.

View developer portfolio

Permissions

Host access