A method performed by data apparatus, the method comprising: receiving , from a device within a network by a network gateway of the network, a request for a resource from a server outside of the network; determining , by the network gateway, that the resource is subject to a policy of the network and that the policy specifies that the resource should be served from a proxy server of the network that is configured to apply the policy to the resource; determining , by the network gateway, that the device does not have a public key certificate of the network installed; serving , by the network gateway to the device and responsive to determining that i) the resource is subject to the policy of the network and ii) the device does not have the public key certificate of the network installed, an informational webpage that comprises a) instructions to install the network's certificate on the device and b) a first interface element that, when selected, causes the device to request a download of the network's certificate; receiving , by the network gateway from the device within the network, an indication that the network's certificate has been installed on the device after it had been downloaded thereon based on a selection of the first interface element; redirecting , by the network gateway responsive to receiving the indication that the network's certificate has been installed on the device, the device to the proxy server configured to apply the policy to the resource; and serving , to the device within the network, the resource from the proxy server configured to apply the policy to the resource, wherein the serving of the resource causes the device to display the resource without displaying an error or warning. receiving , from a device within a network by a network gateway of the network, a request for a resource from a server outside of the network; determining , by the network gateway, that the resource is subject to a policy of the network and that the policy specifies that the resource should be served from a proxy server of the network that is configured to apply the policy to the resource; determining , by the network gateway, that the device does not have a public key certificate of the network installed; serving , by the network gateway to the device and responsive to determining that i) the resource is subject to the policy of the network and ii) the device does not have the public key certificate of the network installed, an informational webpage that comprises a) instructions to install the network's certificate on the device and b) a first interface element that, when selected, causes the device to request a download of the network's certificate; receiving , by the network gateway from the device within the network, an indication that the network's certificate has been installed on the device after it had been downloaded thereon based on a selection of the first interface element; redirecting , by the network gateway responsive to receiving the indication that the network's certificate has been installed on the device, the device to the proxy server configured to apply the policy to the resource; and serving , to the device within the network, the resource from the proxy server configured to apply the policy to the resource, wherein the serving of the resource causes the device to display the resource without displaying an error or warning. <EOS>