Configure certificate authentication

You enable and configure certificate authentication from the Unified Access Gateway administration console.

Prerequisites

• Obtain the root certificate and intermediate certificates from the CA that signed the certificates presented by your users.

  See Obtain the Certificate Authority certificates

• Verify that the Unified Access Gateway SAML metadata is added on the service provider and the service provider SAML metadata is copied the Unified Access Gateway appliance.

• (Optional) List of Object Identifier (OID) of valid certificate policies for certificate authentication.

• For revocation checking, the file location of the CRL and the URL of the OCSP server.

• (Optional) OCSP Response Signing certificate file location.

• Consent form content, if a consent form displays before authentication.

Procedure

1. In the admin UI, click Identity & Access in the left navigation pane.

2. In the X.509 Certificate card, click Configure.

3. Enter the following details and click Save.

   An asterisk indicates a required setting. All other settings are optional.

   Option	Description
   Enable X.509 Certificate	Turn on this toggle to enable certificate authentication.
   Enable Strict Client Certificate Validation	Turn on this toggle to apply stricter validation to client certificates presented to Unified Access Gateway. When this toggle is turned on, Unified Access Gateway accepts a client certificate only if it meets all of the following requirements: - The client certificate must have the client authentication in its EKU extension. - The certificate is a leaf certificate, not a CA certificate. - If the certificate contains a Key Usage extension, it also includes digitalSignature. - Any extension marked as critical is recognized and valid. A certificate with an unrecognized critical extension is rejected. Note: Omnissa recommends to turn on this toggle for additional security. However, ensure that the certificate setup matches with these requirements before upgrading to avoid login issues.
   *Root and Intermediate CA Certificates	To upload the certificate files, click Select. Tip: You can upload a single file containing multiple root CA and intermediate CA certificates that are encoded as DER or PEM. Subsequently, to add another file containing certificates, click Select. - Click View to display the details of the certificates. The following certificate details are displayed: - Subject: The entity to which the certificate is issued. - Issuer: The authority that issued the certificate. - Expiry: The expiration date and time of the certificate. - Serial Number: A unique identifier for the certificate. - Click Delete to remove a previously added certificate. Note: With version 2012 and later, Unified Access Gateway supports the configuration of multiple CA certificates with the same Subject DN. This support is useful when an updated CA issuer certificate uses the same Subject DN but a different key pair. UAG uses the authority key identifier to identify the public key corresponding to the private key used to sign a certificate.
   Enable Cert Revocation	Turn on this toggle to enable certificate revocation checking. Revocation checking prevents users who have revoked user certificates from authenticating.
   Use CRL from Certificates	Turn on this toggle to use the certificate revocation list (CRL) published by the CA that issued the certificates to validate the status of a certificate, revoked or not revoked.
   CRL Location	Enter the server file path or the local file path from which to retrieve the CRL.
   Enable OCSP Revocation	Turn on this toggle to use the Online Certificate Status Protocol (OCSP) certificate validation protocol to get the revocation status of a certificate.
   Use CRL in case of OCSP Failure	If you configure both CRL and OCSP, turn on this toggle to fall back to using CRL if OCSP checking is not available.
   Send OCSP Nonce	Turn on this toggle if you want the unique identifier of the OCSP request to be sent in the response.
   OCSP URL	If you enabled OCSP revocation, enter the OCSP server address for revocation checking.
   Use OCSP URL from certificate	Select this check box to use the OCSP URL.
   Enable Consent Form before Authentication	Select this check box to include a consent form page to appear before users log in to their Workspace ONE portal using certificate authentication.

What to do next

When X.509 Certificate authentication is configured and Unified Access Gateway appliance is set up behind a load balancer, ensure that the load-balancer is configured with SSL pass-through at the load balancer and not configured to terminate SSL. This configuration ensures that the SSL handshake is between the Unified Access Gateway and the client to pass the certificate to Unified Access Gateway.