Search <book_title>...

Access Appliance Online Help

Last Published: 2021-05-09

Product(s): Appliances (7.4.3)

Platform: Veritas 3340,Access Appliance OS

Enabling certificate-based authentication in Access Appliance

Certificate-based authentication in Access Appliance allows the clients connect to the server securely and authenticate clients by using digital certificates. These certificates are trusted and are provided by the customer.

Note:

In case the trusted certificates are not available, the client can use the regular user name and password to log on to the Access Appliance application.

The digital certificates use the public key infrastructure (PKI). The following types of certificates are used for authentication:

Root certificate
A root certificate is a public key certificate that identifies a root certificate authority (CA). This is stored in the browser.
Intermediate certificate
An intermediate certificate is a subordinate certificate issued by the trusted root specifically to issue an end-entity server or client certificates. This is provided to the server. There can be one or more intermediate certificates.
Server or client certificate
- Server certificate - It is issued by the intermediate authority to the specific website for securing a channel.
- Client certificate - It is issued by the intermediate authority to a specific user for authentication purposes.
  Note:
  Server, intermediate, and root certificates are in Privacy Enhanced Mail (PEM) format. Client certificates are in PKCS#12 format.
  Root certificate and intermediate certificates should be the same for the client and the server.

Note:

The certificate-based authentication in Access Appliance bypasses the traditional log-on method of using user credentials.

Figure: Workflow for the initial SSL handshake for exchange of certificates between client and server

Enabling the server to use the external certificates

system gui_servercertificate add: - should provide the server certificate, key, and the CA file.

Enabling the browser to list the client certificate

system gui_clientcertificate authentication enable; - should provide the Online Certificate Status Protocol (OCSP) URI and the client issuer certificate.

When the browser tries to connect to the server, an initial handshake is established by the client. The server sends its certificate and also requests the web browser to send the client certificate, which is stored in the browser. The client certificate contains details about the client for whom the certificate is to be issued. If the browser certificate is not present, the user cannot log on to Access Appliance.

Importing digital certificate in a browser

The digital certificate, which is purchased or received from the CA authority, can be imported in to the browser. The server connects to the client, verifies the certificate details, validates the user, and authenticates it. The digital certificates need to be purchased or received from the CA authority.

Note:

The procedure for importing the digital certificate differs depending on which browser is used to access Access Appliance. See the Veritas Access Installation Guide for the list of the supported browsers.

The following table provides instructions to import the digital certificate in various browsers:

Browser	To import the digital certificate
Mozilla Firefox	From the menu bar, click Tools > Options. In the Options window, click the Advanced tab, and then click the Certificates tab. Click View Certificates. In the Certificate Manager window, click the Authorities tab, and then click Import. Browse to the location of the certificate file and open it. Click OK.
Microsoft Internet Explorer	From the menu bar, click Tools > Internet Options. In the Internet Options window, click the Content tab, and then click Certificates. In the Certificates window, click the Trusted Root Certification Authorities tab, and then click Import. By using the Certificate Import wizard, browse the certificate. Click OK.

If the clients have not listed their own root CA in the standard CA list that comes with the operating system, the root CA also needs to be uploaded.

The following diagram describes the workflow for the browser-certificate validation:

Figure: Workflow for the browser-certificate validation

There are different ways to validate a certificate for its revocation status.

CRL
OCSP (Access Appliance uses this method.)

Validating a certificate

The client receives a client certificate (external certificate) from the certificate authorization authority and imports it into the browser. When the client tries to log on to the Access Appliance application, the connection request is sent to the server.

The server connects to the browser and requests for the client certificate. The server converts the client certificate in to the PEM format if required and sends it to the OCSP URI. The OCSP URI validates the client certificate and the responder certificate is validated using the client issuer certificate provided by the user. Also, a check whether the client has the required rights to access the Access Appliance application is done.

In Access Appliance, the OCSP method is used to validate the client_pem. Each certificate vendor has an OCSP responder to validate the certificates. The OCSP URI is provided by the customer.

The OCSP responder returns the following status types to the server for the root-client certificate validation:

Good - When the OCSP responder finds that the detail of the certificate is good.
Revoked - When the OCSP responder finds the certificate is revoked.
Unknown - When the OCSP responder cannot find any details about the client certificate in its database. The client cannot log on.

Based on the status type that is returned by the OCSP responder, the server authenticates, or denies the client.

Authorizing a user

The details of the user who needs to be authorized are maintained in the Access Appliance database. The subject information in the certificate is used to authorize the user. If the certificate is good, the subject information is used to authorize the user against the authorization server.

The authorization should be changed according to the client's requirement to integrate with Active Directory (AD), Lightweight Directory Access Protocol (LDAP), and so on.

To enable the client authentication, run the following Access command-line interface commands:

system gui_servercertificate add: - provides the server certificate, key, and the CA file
system gui_clientcertificate authentication enable; - provides the OCSP URI
System guienable - starts the server with the newly provided details.

Note:

The server and client root CA should be the same.

Client certificates should be in .pkcs12 format.

All other certificates should be in PEM format.