Require valid HTTPS client certificates

This task configures the system to require users connecting to the web interface to present a valid HTTPS client certificate, enhancing authentication security. Ensure only authorized users with valid certificates can access the web interface.

Use this procedure to require users connecting to the Cloud-Delivered Firewall Management Center web interface to supply a user certificate. The system supports validating HTTPS client certificates using either OCSP or imported CRLs in Privacy-enhanced Electronic Mail (PEM) format.

If you choose to use CRLS, create a scheduled task to ensure that the list of revoked certificates stays current. The system displays the most recent refresh of the CRLS. To access the web interface after enabling client certificates, you must have a valid client certificate present in your browser (or a CAC inserted in your reader).

Note	To access the web interface after enabling client certificates, you must have a valid client certificate present in your browser (or a CAC inserted in your reader).

Before you begin

Import a server certificate signed by the same certificate authority as the client certificate that will be used for the connection .
Import the server certificate chain if needed; .

Follow these steps to require valid HTTPS client certificates.

Procedure

Step 1

Choose Administration > Configuration.

Step 2

Click HTTPS Certificate.

Step 3

Choose Enable Client Certificates. If prompted, select the appropriate certificate from the drop-down list.

Step 4

You have three options:

To verify client certificates using one or more CRLS, select Enable Fetching of CRL and continue with Step 5.
To verify client certificates using OCSP, select Enable OCSP and skip to Step 7.
To accept client certificates without checking for revocation, skip to Step 8.

Step 5

Enter a valid URL to an existing CRL file and click Add CRL. Repeat this step to add up to 25 CRLs.

Step 6

Click Refresh CRL to load the current CRL or CRLS from the specified URLs.

Note	Enabling fetching of the CRL creates a scheduled task to regularly update the CRL or CRLS. Edit the task to set the frequency of the update.

Step 7

Verify that the client certificate is signed by the certificate authority loaded onto the appliance and the server certificate is signed by a certificate authority loaded in the browser certificate store. (These should be the same certificate authority.)

Caution

Saving a configuration with enabled client certificates, with no valid client certificate in your browser certificate store, disables all web server access to the appliance. Make sure that you have a valid client certificate installed before saving settings.

Step 8

Click Save.

After completing this task, only users with valid HTTPS client certificates will be able to access the web interface, and certificate validation will be enforced according to your configuration.