The agent Approving Oxelone on a Mac
Approving Oxelone on a Mac
TLS interception needs the Mac to trust a certificate the agent makes for that machine. macOS lets nothing add a trusted certificate without an administrator's say-so, so on a Mac with TLS interception enrolled the agent makes the certificate and then waits for someone to approve it.
Until somebody does, the agent captures everything else it was enrolled with, and AI traffic over TLS passes through without being decrypted.
What the person sees
The companion, running in the signed-in person's session, asks them. They see a window titled Approve Oxelone on this Mac, with Approve and Later. Approve opens macOS's own authorization window, which asks for an administrator's name and password. Oxelone never asks for the password in a window of its own, and never sees it.
The companion asks when the person signs in, and at most once a day after that. It stops asking as soon as the Mac trusts the certificate, however that happened.
When the person is not an administrator
The companion checks first. A person who is not an administrator is told that an administrator needs to approve it, and is not asked again every day. An administrator can sign in to the Mac and approve it, or use one of the ways below.
In the console
A Mac waiting for an administrator reads Not approved on its page, with Waiting for an administrator to approve Oxelone on this Mac, and when the person was last asked and how that went. It is not treated as broken: nothing else on the machine is affected.
Ask now beside it asks the person signed in again, on the Mac's next
heartbeat, instead of waiting for the next day. It needs fleet:manage.
New sites once it is approved
The certificate is limited to the AI sites the workspace's catalog named when it was made. When the catalog adds a site later, the Mac keeps the certificate it has, so nobody is asked to approve it again for every change. Traffic to the new sites passes through without being decrypted, and the machine stays Healthy. Its page says how many sites wait, for example 3 new sites wait until an administrator approves them on this Mac, with Ask now beside it. Approving the next certificate covers them.
When a certificate nears the end of its life, the agent makes its replacement first and keeps the old one trusted until the new one is approved.
Approving from Terminal
An administrator can approve it on the Mac without the companion:
With an MDM
An MDM can install a certificate as trusted with a configuration profile's
certificate payload (com.apple.security.root), and then nobody is asked.
This is the only way to make it silent. Each Mac's certificate is its own, so
the profile has to carry that Mac's certificate.