Certificate Authority Required for Certificate Authentication in Omnissa Access

To enable logging in using certificate authentication, root certificates and intermediate certificates is uploaded to the Omnissa Access service.

The certificates are copied to the local certificate store on the user's computer. The certificates in the local certificate store are available to all the browsers running on this user's computer, with some exceptions, and therefore, are available to a Omnissa Access instance in the browser.

For smart-card authentication, when a user initiates a connection to the Omnissa Access instance, the Omnissa Access service sends a list of trusted certificate authorities (CA) to the browser. The browser checks the list of trusted CAs against the available user certificates, selects a suitable certificate, and then prompts the user to enter a smart card PIN. If multiple valid user certificates are available, the browser prompts the user to select a certificate.

If a user cannot authenticate, the root CA and intermediate CA might not be set up correctly, or the service has not been restarted after the root and intermediate CAs were uploaded to the server. In these cases, the browser cannot show the installed certificates, the user cannot select the correct certificate, and certificate authentication fails.