Internet Filtering (Lightspeed Systems): SSL Filtering Android Device .

In confidence Internet Filtering (Lightspeed Systems): SSL Filtering Android Device Configuration Reference: LS AND Version: V1.2 Date: 28 July 2017 Owner(s): Suhayl Sidat/ Colin Helliwell

BT Lancashire Services Education Services SSL Filtering Android Device Configuration Contents Page 1 Setting Up Android Devices for Lightspeed Filtering 5 1.1 1.2 Configure School Wi-Fi with Lightspeed Proxy Settings Download SSL Certificate onto Android Devices 5 7 2 Testing Version 1.2 July 2017 11 1 Page 2 of 11

BT Lancashire Services Education Services SSL Filtering Android Device Configuration Audience: These notes are intended to be used by Schools ICT technician, network manager or third party ICT support organisation. These notes are only for schools using a CLEO connection to access the internet. Version 1.2 July 2017 1 Page 3 of 11

BT Lancashire Services Education Services SSL Filtering Android Device Configuration Executive summary The Lightspeed Systems SSL filtering option allows schools to have their internet filtering policies applied and to decrypt and report on the content of secure searches to Google, YouTube and Bing. Schools who opt to use this filtering will need to reconfigure their computers (please see appropriate BTLS documentation) accordingly. This guidance will show how Schools on the CLEO network can configure Android devices with Lightspeed filtering, using manual Proxy settings. Currently this means that SSL decryption on Android devices can only be user initiated through the full proxy. There is no way to remotely push Proxy settings, PAC files or certificates out to Android devices, either managed or Bring Your Own Devices. Please note; this isn’t a Lightspeed specific issue, this is an issue that all content filters and MDMs will have to deal with that is caused by limitations in the Android Operating System. If devices use manual Proxy settings, then the decryption works correctly but there is no way to force, or restrict, users to this. Therefore, it is the School's responsibility to ensure all Android devices are configured for web filtering. Version 1.2 July 2017 1 Page 4 of 11

BT Lancashire Services Education Services SSL Filtering Android Device Configuration 1 Setting Up Android Devices for Lightspeed Filtering There are two stages to complete in order for this to work successfully. These are: Configure School Wi-Fi with Lightspeed Proxy settings. Downloading the SSL Certificate. 1.1 Configure School Wi-Fi with Lightspeed Proxy Settings The Wi-Fi settings can be configured before and after joining the School's Wi-Fi Network. a) Go in to the Wi-Fi Network you wish to join, as shown below. Then press "Advanced Options". Alternatively, if you have already joined the Network, press and hold the Wi-Fi network for a couple of seconds and a similar screen will pop up, as below: Press "Modify Network" which will bring the password box, as shown above. Press "Advanced Options". Version 1.2 July 2017 1 Page 5 of 11

BT Lancashire Services Education Services SSL Filtering Android Device Configuration b) You will see a similar screen to the one below: Input in the Proxy hostname field proxy.filter.education.btlsl.co.uk along with the Proxy port number and click "Save". To locate the Proxy Port number: Log into Lightspeed Rocket (filter.education.btlsl.co.uk). Version 1.2 July 2017 1 Page 6 of 11

BT Lancashire Services Education Services SSL Filtering Android Device Configuration Once you've logged in, you should select the Web Filter option from the menu on the left hand side of the dashboard screen. Then click the Proxy Server option. (Make sure the tier name is correct for your school, at the top left). The Proxy Port number is located here. 1.2 Download SSL Certificate onto Android Devices Now that the Wi-Fi settings have been configured, if you open the browser app and access Google.com, you will see a similar screen to the one below: Version 1.2 July 2017 1 Page 7 of 11

BT Lancashire Services Education Services SSL Filtering Android Device Configuration As the device's internet access is now being monitored by Lightspeed, its security is unable to establish an encrypted link between the web server and the browser. Therefore, a digital certificate, known as Secure Sockets Layer (SSL) Certificate, needs to be installed on the Android device in order to establish this connection. This will prevent the above message from appearing in the future. To download the SSL certificate: a) Type the following web address on your Android Browser: cert This will start downloading the certificate. Once downloaded, you will see a pop-up message like the one below: b) Click on "Open". Alternatively, if you have missed the pop-up message, you can access the downloaded file from the device's Downloads folder. You will see the next screen, as below: Version 1.2 July 2017 1 Page 8 of 11

BT Lancashire Services Education Services SSL Filtering Android Device Configuration c) Give the certificate a name e.g. Lightspeed SSL. Click on the arrow next to "Credential Use", this will give you two options, VPN and Apps and Wi-Fi. Select "Wi-Fi" and then press OK. This will add the certificate into the device's trusted credentials. You can view this by going to the Settings menu – Security – touch trusted credentials – touch the User tab. Please note: In order for the certificate to be installed on the device, you will need to set up a screen lock on your Android device. Otherwise, the certificate won't install. This can be setup as a pin, pattern or password. Version 1.2 July 2017 1 Page 9 of 11

BT Lancashire Services Education Services SSL Filtering Android Device Configuration d) You will see a message in the notifications list, such as the one below: This message can be ignored. It's just to advise that the network is being monitored by Lightspeed. Re-open browser and access Google.com. You should be able to access the webpage without any warnings about your network connection. Version 1.2 July 2017 1 Page 10 of 11

BT Lancashire Services Education Services SSL Filtering Android Device Configuration 2 Testing After reconfiguration, schools should test devices to ensure that the SSL filtering is working correctly. Please follow the steps below: a) On the device to be tested, open a web browser and navigate to https://images.google.com/ b) Enter the word "pokerchip". c) Correct configuration If filtering is running correctly, some of the returned thumbnails will have a blue cross image. These blue crosses represent results from blocked websites. d) Incorrect configuration If filtering is not running correctly, all images will be returned. Please check the configuration on this device. Your Android device(s) are now set up to work alongside Lightspeed Filtering. Version 1.2 July 2017 1 Page 11 of 11

SSL Filtering Android Device Configuration Version 1.2 July 2017 1 Page 9 of 11 c) Give the certificate a name e.g. Lightspeed SSL. Click on the arrow next to "Credential Use", this will give you two options, VPN and Apps and Wi-Fi. Select "Wi-Fi" and then press OK. This will add the certificate into the device's trusted credentials.