ChatGPT

To configure ChatGPT, enter the list of Enterprise workspace IDS you want to allow access to.

This control is limited to ChatGPT Enterprise customers.

Access to all other ChatGPT accounts will be blocked.

If a user tries to access the account that is that an Enterprise Account not in the allowed list, then a ChatGPT block page is shown:

ChatGPT Tenant Restriction Error Modal

Resolve certificate pinning message on macOS

The ChatGPT macOS desktop app uses certificate pinning and requires an extra step to work correctly. The app will show an error below until this is resolved:

ChatGPT blocked by certificate pinning when dope inspects its traffic

To resolve, ChatGPT requires you to push an MDM profile with the certificate pinning exception. This adds the dope.security root CA to the com.openai.pinned_cert_hash_list so interception is honored on managed devices.

Deploy the MDM profile below (com.openai.chat) via MDM, scoped to all macOS devices. This will allow the dope.security root CA. Download the profile or copy the XML below.

dope.security-ChatGPT-cert-pin-exception.mobileconfig

2KB

Open

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>PayloadType</key>
            <string>com.openai.chat</string>
            <key>PayloadIdentifier</key>
            <string>com.openai.chat.6F319227-5470-486E-B3E0-05F94E6129CC</string>
            <key>PayloadUUID</key>
            <string>6F319227-5470-486E-B3E0-05F94E6129CC</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <key>PayloadDisplayName</key>
            <string>ChatGPT Managed Configuration</string>
            <key>PayloadDescription</key>
            <string>Adds the dope.security root CA to the ChatGPT certificate pin exception list so TLS interception is honored on managed devices.</string>
            <key>com.openai.pinned_cert_hash_list</key>
            <array>
                <string>iNWD5OB/39KJxie93dnbzXfmJjiM8unOxvVv6BlFXMM=</string>
            </array>
        </dict>
    </array>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
    <key>PayloadIdentifier</key>
    <string>security.dope.chatgpt.cert-pin-exception</string>
    <key>PayloadUUID</key>
    <string>873EDEBC-998C-4B8D-B99E-35C00EBAFC3C</string>
    <key>PayloadDisplayName</key>
    <string>ChatGPT – dope.security Certificate Pin Exception</string>
    <key>PayloadDescription</key>
    <string>Allows the ChatGPT desktop/mobile app to accept TLS interception by the dope.security secure web gateway by pinning the dope.security root CA SPKI hash.</string>
    <key>PayloadOrganization</key>
    <string>dope.security</string>
    <key>PayloadScope</key>
    <string>System</string>
    <key>PayloadRemovalDisallowed</key>
    <false/>
</dict>
</plist>

Pinning is checked against every certificate up to the trusted root, so adding the dope.security root CA hash is sufficient. Multiple hashes can be listed to cover additional/test CAs.