Prerequisites Validation
Before deploying, prove from a pilot device that the Quilr CDN, your tenant-specific update
manifest, and the .crx package are all reachable and not being re-signed by an upstream proxy. These are the
exact checks Step 6 troubleshooting falls back to — running them now prevents most rollout failures.
403/404 almost always means a wrong tenant ID
in the request, not a network problem.Quick smoke test — every URL in one shot
Paste this single script in an elevated shell on the pilot device. It probes every host in the Step 1 allow-list — the three shared backplane hosts plus the base / DLP / auth URLs for the environment selected in the top bar (the hosts auto-swap when you change the Environment dropdown). If everything prints [OK], you can skip the per-host checks below.
Hosted check — recommended, nothing to paste:
& ([scriptblock]::Create((irm https://quilr-extensions.quilr.ai/Quilr-SOP/BrowserExtension/Windows/quilr-be-connectivity-check.ps1))) -Env uspocDownloads blocked? Paste this full script instead
$hosts = @(
# Shared — all environments
'quilr-extensions.quilr.ai',
'discover.quilrai.dev',
'log.quilrai.dev',
# Tenant base + DLP + Auth — selected environment
'app.quilr.ai',
'dlpone.quilr.ai',
'auth-extension.quilr.ai'
)
$failed = @()
foreach ($h in $hosts) {
$ok = Test-NetConnection $h -Port 443 -InformationLevel Quiet -WarningAction SilentlyContinue
if ($ok) {
Write-Host ("[OK] {0}" -f $h) -ForegroundColor Green
} else {
Write-Host ("[FAIL] {0}" -f $h) -ForegroundColor Red
$failed += $h
}
}
if ($failed.Count -eq 0) {
Write-Host "All hosts reachable on TCP/443." -ForegroundColor Green
exit 0
} else {
Write-Host ("Blocked: " + ($failed -join ', ')) -ForegroundColor Red
Write-Host "Allowlist the blocked hosts on the firewall AND SSL-bypass them on any TLS-intercepting SWG, then re-run." -ForegroundColor Yellow
exit 1
}Hosted check — recommended, nothing to paste:
curl -fsSL https://quilr-extensions.quilr.ai/Quilr-SOP/BrowserExtension/macOS/quilr-be-connectivity-check.sh | bash -s -- --env uspocDownloads blocked? Paste this full script instead
hosts=(
# Shared — all environments
quilr-extensions.quilr.ai
discover.quilrai.dev
log.quilrai.dev
# Tenant base + DLP + Auth — selected environment
app.quilr.ai
dlpone.quilr.ai
auth-extension.quilr.ai
)
failed=()
for h in "${hosts[@]}"; do
if nc -zv -G 5 "$h" 443 >/dev/null 2>&1; then
printf '\033[32m[OK]\033[0m %s\n' "$h"
else
printf '\033[31m[FAIL]\033[0m %s\n' "$h"
failed+=("$h")
fi
done
if (( ${#failed[@]} == 0 )); then
printf '\033[32mAll hosts reachable on TCP/443.\033[0m\n'
exit 0
else
printf '\033[31mBlocked: %s\033[0m\n' "${failed[*]}"
printf '\033[33mAllowlist on firewall AND SSL-bypass on any TLS-intercepting SWG, then re-run.\033[0m\n'
exit 1
fi[OK] and the script exits with All hosts reachable on TCP/443.. Any [FAIL] — allowlist that host and SSL-bypass it on any TLS-intercepting SWG, then re-run. Use the per-host checks below to drill into a specific failure (e.g. tenant-ID 403, SWG cert re-signing).Check 1 · CDN reachability
Test-NetConnection quilr-extensions.quilr.ai -Port 443 -InformationLevel Quietnc -zv -G 5 quilr-extensions.quilr.ai 443True / succeeded. A timeout means allowlist quilr-extensions.quilr.ai on TCP/443.Check 2 · Tenant manifest reachable
$tid = '<TENANT-ID>'
Invoke-WebRequest "https://quilr-extensions.quilr.ai/$tid/manifest.xml" |
Select-Object StatusCode, @{n='Bytes';e={$_.RawContentLength}}TENANT_ID="<TENANT-ID>"
curl -fsSL "https://quilr-extensions.quilr.ai/${TENANT_ID}/manifest.xml" | head -3200, non-zero bytes, and XML starting with <gupdate xmlns="http://www.google.com/update2/response"…>.| Failure | Cause & fix |
|---|---|
| 403 / 404 | Wrong tenant ID in the URL — confirm with support@quilr.ai |
| Connection timeout | Allowlist quilr-extensions.quilr.ai |
| SSL error | An upstream SWG is decrypting the host and presenting its own cert — add it to the SSL-bypass list |
Check 3 · .crx package reachable
The manifest’s codebase attribute points to the .crx. Confirm it serves correctly:
TENANT_ID="<TENANT-ID>"
curl -sI "https://quilr-extensions.quilr.ai/${TENANT_ID}/vanguard.crx" \
| grep -iE 'HTTP/|content-type|content-length'200, Content-Type: application/x-chrome-extension, and a non-zero Content-Length.Check 4 · File-type / MIME allow-list
Some SWG / download-control policies block or rewrite responses based on file extension or Content-Type. The Browser Extension flow needs six file types to download cleanly: .exe (helper binaries), .msi (Windows installer), .msp (Windows patch), .json (tenant config), .xml (update manifest), and .crx (the extension package itself). This check downloads a tiny probe file per extension and verifies it returns HTTP 200, the content marker is intact (a proxy block-page would be missing it), and the Content-Type header survived.
Hosted check — recommended, nothing to paste:
& ([scriptblock]::Create((irm https://quilr-extensions.quilr.ai/Quilr-SOP/BrowserExtension/Windows/quilr-be-filetype-check.ps1)))Downloads blocked? Paste this full script instead
$base = 'https://quilr-extensions.quilr.ai/Quilr-SOP/EndpointAgent/mime-test'
$marker = 'QUILR-MIME-PROBE-OK'
$exts = 'exe','msi','msp','json','xml','crx'
$fail = $false
"{0,-6} {1,-12} {2}" -f 'Ext', 'Status', 'Content-Type'
foreach ($e in $exts) {
$status='BLOCKED'; $ct='-'
try {
$r = Invoke-WebRequest -Uri "$base/probe.$e" -UseBasicParsing -TimeoutSec 15
$ct = "$($r.Headers['Content-Type'])"; if (-not $ct) { $ct='(none)' }
$body = if ($r.Content -is [byte[]]) { [Text.Encoding]::ASCII.GetString($r.Content) } else { [string]$r.Content }
if ($r.StatusCode -eq 200 -and $body -like "*$marker*") { $status='OK' }
elseif ($r.StatusCode -eq 200) { $status='ALTERED' }
} catch {
if ($_.Exception.Response) {
$c=[int]$_.Exception.Response.StatusCode
if ($c -eq 404) { $status='NO-PROBE'; $ct="HTTP 404 (no probe.$e at base)" } else { $ct="HTTP $c" }
}
}
"{0,-6} {1,-12} {2}" -f ".$e", $status, $ct
if ($status -in 'BLOCKED','ALTERED') { $fail = $true }
}
if ($fail) { Write-Host 'RESULT: BLOCKED/ALTERED - allow on SWG and re-run.' -ForegroundColor Red }
else { Write-Host 'RESULT: all probed types pass.' -ForegroundColor Green }Hosted check — recommended, nothing to paste:
curl -fsSL https://quilr-extensions.quilr.ai/Quilr-SOP/BrowserExtension/macOS/quilr-be-filetype-check.sh | shDownloads blocked? Paste this full script instead
BASE='https://quilr-extensions.quilr.ai/Quilr-SOP/EndpointAgent/mime-test'
MARKER='QUILR-MIME-PROBE-OK'
TMP="${TMPDIR:-/tmp}/quilr_be_probe.$$"
FAIL=0
printf '%-6s %-12s %s\n' 'Ext' 'Status' 'Content-Type'
for e in exe msi msp json xml crx; do
meta=$(curl -sS -m 15 -o "$TMP" -w '%{http_code}|%{content_type}' "$BASE/probe.$e")
http=${meta%%|*}; ctype=${meta#*|}; [ -n "$ctype" ] || ctype='(none)'
case "$http" in
200) if grep -q "$MARKER" "$TMP"; then status=OK; else status=ALTERED; FAIL=1; fi ;;
404) status=NO-PROBE; ctype="HTTP 404 (no probe.$e at base)" ;;
*) status=BLOCKED; ctype="HTTP ${http:-000}"; FAIL=1 ;;
esac
printf '.%-5s %-12s %s\n' "$e" "$status" "$ctype"
done
rm -f "$TMP"
if [ "$FAIL" -eq 0 ]; then printf '\033[32mRESULT: all probed types pass.\033[0m\n'
else printf '\033[31mRESULT: BLOCKED/ALTERED - allow on SWG and re-run.\033[0m\n'; fiOK and the final result is all probed types pass.. A BLOCKED row means the SWG / web-filter is dropping that extension — allow it. ALTERED means the body was rewritten (block page) — SSL-bypass the host. NO-PROBE just means the probe file for that extension isn’t on the CDN yet; not a SWG block..crx serves with the correct content-type, all with
no SSL interception. You’re clear to install.