The SSL VPN service supports authentication via client certificates either as the only authentication method, or in combination with user/password authentication. The client certificates must be installed on the client devices and can be used for the desktop and mobile portal as well as CudaLaunch on iOS and Android.
Before You Begin
- Configure the SSL VPN service. For more information, see How to Configure the SSL VPN Service.
- Create root and client certificates. For more information, see How to Create Certificates for a Client-to-Site VPN.
- If you are using a mobile device, verify that client certificate authentication is supported. For more information, see SSL VPN Supported Browsers, Devices, and Operating Systems
Step 1. Import the Root Certificate for VPN Service
Import the root certificate used to verify the client certificates. The certificate must be in PEM or CER format.
- Go to CONFIGURATION > Configuration Tree > Box > Assigned Services > VPN > VPN Settings.
- Click Lock.
- In the left menu, select Root Certificates.
- Right-click in the list and select Import PEM from File or Import CER from File depending on the format of your certificate file.
- Select the certificate on your disk. The Root Certificate window opens.
- Enter a Name.
- Click OK.
- Click Send Changes and Activate.
The root certificate is now shown in the Root Certificates ist.
Step 2. Configure Client Authentication for SSL VPN
Configure the SSL VPN to use client certificate authentication.
- Go to CONFIGURATION > Configuration Tree > Box > Assigned Services > VPN > SSL VPN.
- Click Lock.
- In the left menu, expand the Configuration Mode section and click Switch to Advanced Mode.
- Set Use Client Certificate Authentication:
- yes – Select to use client certificate authentication in addition to user/password authentication.
- cert-only – Select to only use certificate authentication.
- Click + to add an entry to the Root Certificates list. The Root Certificates window opens.
- Enter a Name and click OK.
- Select the root certificate you uploaded in Step 1 from the Client Root Certificate drop-down menu.
- (optional) Add Subject Restrictions to allow only client certificates matching these patterns to connect.
- Click OK.
- Click Send Changes and Activate.
Step 3. Restart the VPN Service
You must restart the VPN service for the changes to take effect.
- Go to CONTROL > Services.
- In the Services section, select the VPN service.
- Click on the blue arrow icon on the right of the service and select Restart Service.
You can now use client certificate authentication to log into the SSL VPN desktop and mobile portals as well as CudaLaunch.
Next Steps
Install the client certificates on your client devices. When used in combination with CudaLaunch, see How to Configure CudaLaunch for Mobile with Client Certificate Authentication.