Step-By-Step Configuration Authentication Profiles

Configure an LDAP Authentication Profile

To configure an LDAP authentication profile in Concerto and then publish the profile to gateways:

1. In Tenant view, go to Configure > Security Service Edge > User and Device Authentication > Profiles.

   

2. Click +Add. The following screen displays.
   
   
3. Select LDAP and then click Get Started. The Add LDAP Authentication Profile workflow displays.
   
   
4. In step 1, Settings, enter information for the following fields.
    

   Field	Description
   Server Type	Select Active Directory.
   FQDN or IP Address	Select either FQDN or IP Address, and then enter the fully qualified domain name (FQDN) or IP address of the AD server. For example, enter adserver.company.local for the FQDN or 10.163.106.33 for the IP address.
   VPN Name	Enter the VPN instance or network segment this authentication profile applies to. For example, ACME-ONE-Enterprise.
   Port	Enter the port number to use for communication with the AD server. For example,  port 389 which is the default LDAP port, or port 636 which is the default LDAP over SSL (LDAPS) port.
   Enable/Disable SSL	Click the toggle to enable or disable SSL/TLS for the connection between Versa and the AD server. If enabled, you must also select the SSL mode and CA certificate in the next two fields. Default: Disabled.

5. Scroll down to enter information for additional fields.
   
   

   Field	Description
   SSL Mode	If SSL is enabled, select the encryption method: LDAPS or STARTTLS.
   CA Certificate	Select the CA certificate.
   Bind DN	Enter the bind distinguished name (DN). The bind DN is the service account Versa uses to connect to and query the AD directory. The bind DN allows Versa to authenticate itself to the AD server, enabling it to search for users and groups. For information about looking up the bind DN, see Find Base and Bind DNs in Active Directory.   Example: cn=Administrator,cn=users,dc=versa,dc=com
   Bind Password	The password for the bind DN account.
   Base DN	Enter the base DN. This is the starting point in the LDAP directory tree from which searches begin. It defines the organizational scope of the LDAP search.  Example: cn=users,dc=versa,dc=com
   Domain Name	The name of the AD domain. Example: versa.com
   Search Timeout (sec)	The maximum time, in seconds, Versa waits for a response from the LDAP server during a query. Default: 30
   Cache Expiry Time (mins)	How long, in minutes, user or group information retrieved from LDAP is cached before refreshing. Default: 10
   Concurrent Logins	The maximum number of concurrent sessions allowed for the same user. Default: 3

6. Click Next or select step 2, User and Group Profiles. 
   
   
7. Enter information for the following fields.
    

   Field	Description
   Group Object Class	Enter group. This is the standard AD object class for security and distribution groups and is required in order to identify groups in the directory.
   Group Name	Enter name. This is the attribute that defines the display name of a group and is used to match groups during policy evaluation.
   Group Member	Enter memberof. This is the attribute that lists group memberships for a user object and is used to apply policies based on AD group membership.
   User Object Class	Enter user. This is the standard AD object class for user account and is required for identifying users in the directory.
   User Name	Enter the attribute used for login. Note that userPrincipalName (for example, user@versanetworks.com) is preferred, but sAMAccountName is supported.
   Refresh Interval (sec)	The interval at which Versa refreshes user and group information from LDAP, in seconds. This value can be tuned based on the frequency of directory changes. Default: 21600 (6 hours)
   Password Last Set	Enter pwdLastSet. This attribute records the date and time a user’s password was last changed, and is useful for enforcing password expiration policies.
   Password Max Age	Enter maxPwdAge. This attribute defines the maximum password lifetime and is derived from the AD domain password policy.

8. Click Next to go to step 3, Review and Submit.
   
   
9. Enter a name for the profile and review all parameters to ensure they are correctly configured.
10. Click Save to save the profile to Concerto.
11. Click Publish to publish the profile to gateways. You must publish the profile for it to take effect.

    
    

Verify the LDAP Configuration

To verify that LDAP authentication is working, create a secure-access test rule and then check whether the user or group list is populated.

To verify the LDAP configuration in Concerto:

1. In Tenant view, select Configure > Security Service Edge > Secure Access > Client-Based Access > Rules. The Client-Based Access Rules table displays.
2. Click + Add to create a new Secure Access client rule, or edit an existing rule. The workflow for the client-based access rule displays.
   
   

3. Go to step 2, Users & Groups.
4. Click Customize. The following screen displays.
   
   
5. Click Selected Users in the User Type field.
6.  In the Enable Rule field, select your authentication profile from the drop-down list. This allows the policy to enforce access control based on AD group membership.
7. To add specific users or groups, select the User Groups or Users tab, and then add or select user groups and users for which to enforce security policies.
   
   
8. Click Skip to Review.
9. After reviewing all configuration sections, click Save to apply the settings to the current secure access profile. The screen returns to the Client-Based Access Rules table.
10. Click Publish to publish the updated profile to gateways.

Configure SAML Application Integration

1. Log in to your Okta admin console.
2. Go to Applications > Applications, and then click Create App Integration.

   

3. In the Create a new app integration window, click SAML 2.0, and then click Next.

   

4. In the General Settings section, select App Name, and then enter an application name.

   

5. Click Next. The following screen displays.
   
   
6. Enter information for the following fields.
    

   Field	Description
   Single Sign-On URL	Enter the URL where Okta sends SAML responses in the following format: https://<sase-gateway-fqdn>/versa-flexvnf/saml/login-consumer For example: https://acme-one-sasegwdiegos-lab.versanow.net/versa-flexvnf/saml/login-consumer
   Audience URI (SP Entity ID)	Enter the Service Provider (SP) entity ID in the following format: https://<sase-gateway-fqdn>/metadata For example:  https://acme-one-sasegwdiegos-lab.versanow.net/metadataa
   Default Relay State	Enter the state used for IdP-initiated SSO in the following format: System user: vd-ui::system  Tenant user: vd-ui::<organization-name>
   Attribute Statements	Enter attributes such as role, organization, and idle timeout. This field is case sensitive.
   Group Attribute Statements (optional)	Enables Versa to import user-to-group mappings from the Okta configuration. Name—For example, https://schemas.microsoft.com/ws/2008/06/identity/claims/group Name Format—For example, unspecified. Filter—Select a filter and then enter the regular expression. .* This group of statements ensures all groups a user belongs to are included in the SAML assertion, enabling group-based policies such as Internet Protection and Private App Protection,
   Preview the SAML Assertion	Click to preview the assertion, as displayed in the following screen shot. Use this to copy the metadata and save it as an XML file for the Versa configuration.

5. Click Next.
6. In the Help Okta Support Understand How you Configured this Application section, you can optionally provide information for Okta Support.
   • Under App type, check. This is an internal app that is recommended for internal SSO integrations like Versa.
   • Click Finish to complete the SAML integration setup.
7. Retrieve the SAML integration details. Okta displays the SAML configuration details required to set up the SAML profile in Versa Concerto. 
   
8. Copy the Sign on URL and the Issuer value.
9. Download the Signing Certificate file. Note that the certificate file has a .cert file extension. You must rename the file to have file extension .crt before use.

Add Users to the Application

1. In Okta, go to Directory > Groups, then click Add group.

   

2. In the Name field, enter a group name.

   

3. Refresh the page and click the newly created group.
4. Select the Applications tab, and then click Assign applications.

   

5. Select the SAML application you previously created.

   

6. To create users, go to Directory > People.
   
   
7. Click Add Person. The following screen displays.
   
   
   8. Enter information for the following fields.
       

      Field	Description
      User Type	Select User.
      First Name	Enter a first name.
      Last Name	Enter a last name.
      User Name	Enter a user name.
      Primary Email	Enter an email address.
      Groups	Select the group you previously created.
      Activation	Select Activate Now, and then click one of the following fields: I Will Set Password—Click to set the password immediately, and then enter a password. User Must Change Password on First Login—Click to force the user to change password on first login.

   9. Click Save.

Configure an Okta Authentication Profile

To configure an Okta authentication profile in Concerto and then publish the profile to gateways:

1. In Tenant view, select Configure > Security Service Edge > User and Device Authentication > Profiles.

   

2. Click +Add. The following screen displays.
   
   
3. Select SAML, and then click Get Started. The Add SAML Authentication Profile workflow displays.
   
   
4. In the SAML Type field, select the OKTA icon.
5. Enter information for the following fields. The values you enter here should match the information you entered in the Okta admin console (see Configure SAML Application Integration, above). 
    

   Field	Description
   Single Sign-on URL	Enter the URL of the IdP to use for single sign-on.
   Service Provider Entity ID	Enter the entity ID of the service provider. For example, https://acme-one-sasegwdiegos-lab.versanow.net/metadata.
   Identity Provider Entity ID	Enter the entity ID that uniquely identifies the SAML IdP. For example, http://www.okta.com/exkXXXXXXXXXXXXXXXXX.  To add a new service provider certificate, see the next step in this procedure.
   Prefix ID	Enter OKTA.

6. (Optional) To upload an identity provider certificate:
   1. Click + Add New to the right of the Identity Provider Certificate field. Rename the downloaded certificate file from .cert to .crt before using it in Concerto.

      
      
      The following window displays.
      
      

   2. Enter a CA-chain name in the CA-Chain Name field.
   3. Click Upload File. The certificate uploads and its name is displayed on the screen.
      
      
   4. Click Add. The screen returns to the Add SAML Authentication Profile workflow.
7. Click Next to go to step 2, Users and User Groups. You can associate either an individual user list or a complete group list with the SAML authentication profile. The advantage of this approach is that a group or user list can be adjusted and applied within the authentication profile, allowing you to enforce a specific secure access rule for those users.
8. Select either the User or Group tab, enter information into the window, and then click +Add.
   
   
9. Click Next to go to workflow step 3, Review and Submit.
10. Enter a name and description for the profile.
11. Review all configuration details.

    

12. Click Save to create the SAML authentication profile. The screen returns to the User and Device Authentication Profile table.
13. To publish the authentication profile, click Publish. Note: After creating and publishing the authentication profile, you must apply it to a Secure Access client policy to enforce authentication and apply the corresponding security policies.

Verify SAML 

When a user connects to the gateway and SAML is enabled, the gateway redirects the login to the configured IdP, such as Okta or Entra ID. After the user enters their credentials, the IdP returns a signed SAML assertion to the gateway. The gateway validates the signature and audience, extracts the NameID and any mapped attributes, such as email and roles. If successful, it establishes the session and applies the matching secure access policy.

You can verify authentication events in Concerto under View > Dashboard > Secure Access > Users > Events, where successful and failed attempts are logged with details such as username, tunnel IP, and applied profile.

The method used and the authenticated user also appear in the authentication logs under View > Dashboard > Secure Access > Logs > Authentication > Events.

Administrators can also confirm active sessions and mapped users from the CLI on the SASE gateway by entering the following commands:

gateway$ cli
gateway> configure
gateway% show orgs org-services <ORG-NAME> user-identification live-users list brief

For example:

Create the Enterprise Application

1. Log in to your Entra ID/Azure portal and go to Enterprise Applications > New Application.

   

2. To create a new application:
   1. Click + Create your own application.
      
      
   2. In the What's the Name of your App field, enter the application name (here, ACME-ONE-SAML).
   3. Select Integrate any other application you don't find in the gallery (Non-gallery).
   4. Click Create.
3. Open the newly created application.
   
   
4. Select Single sign-on, and then click SAML.
   
   
5. Enter information for the following fields.

   Field	Description
   Identifier (Entity ID)	Enter the service provider entity ID in the following format: https://<sase-gateway-fqdn>/metadata. For example: https://acme-one-sasegwdiegos-lab.versanow.net/metadata
   Reply URL (Assertion Consumer Service URL) and Sign on URL (optional)	Enter the URL to which Okta sends OAuth responses in the following format: https://<sase-gateway-fqdn>/versa-flexvnf/saml/login-consumer For example: https://acme-one-sasegwdiegos-lab.versanow.net/versa-flexvnf/saml/login-consumer
   Attribute Statements	Enter the role, organization, and idle timeout attributes. The attribute strings are case-sensitive.
   Group Attribute Statements (Optional)	Configure a group attribute statement as follows: Name: https://schemas.microsoft.com/ws/2008/06/identity/claims/groups Name format: Unspecified Filter: Select Regex (or equivalent) and enter .* This allows Versa to receive all user-to-group mappings from Okta and ensures that all groups a user belongs to are included in the SAML assertion. Versa uses this information to apply group-based mappings for Internet Protection rules, Private App Protection, and other user-based policies.
   Preview the SAML Assertion	Click to preview the SAML assertion. Use this to copy the metadata and save it as an XML file. For example:

6. Click Save.
7. Go to Home > Enterprise Applications > <application-name> > SAML-based Sign-on > Attributes & Claims.
   
   
8. Click +Add New Claim. 
9. Enter the following values, as shown below:
   • Name—givenname 
   • Source Attribute—user.givenname
     
     
10. Click Save.
11. Click +Add New Claim.
12. Enter the following values, as shown below:
    • Name—organization 
    • Source Attribute—Enter the organization name (here, ACME-ONE)
      
      
13. Click Save.
14. Click +Add New Claim.
15. Enter the following values, as shown below:
    • Name—role
    • Source Attribute—user.assignedroles
      
      
16. Click Save.
    
    
17. Click + Add a Group Claim. The following screen displays. Note that group claims refer to the Group Attribute Statements field from the previous section.
    
    
18. Select All Groups, and then select Group ID from the Source Attribute drop-down list.
19. Click Advanced options to display additional fields.groups.

    

20. Click the checkbox for Customize the Name of the Group Claim.
21. In the Name field, enter the following value: groups. 
22. Click the checkbox for Apply Regex Replace to Groups Claim Content.

    

23. Enter the following values, as shown above:
    • Regex Pattern—  .*
    • Regex Replacement Pattern— $0
24. Click Save.
25. To display SAML integration details. select Home > App Registrations > Enterprise Applications > <application-name>. Entra ID displays the SAML configuration details required to set up the SAML profile in Versa Concerto. Copy the Login URL, Microsoft Entra Identifier, and Logout URL, and download the Signing Certificate file.
    
    

Create Groups and Users

1. In the Microsoft Entra Admin Center, select Groups in the left menu bar, and then click New Group.
   
   
   
   The New Group screen displays.
   
   
2. In the Group Name field, enter the group name (here, VIP_Group).
3. Click Create.
4. Refresh the page, and then click the newly created group (here, VIP_Group). 
5. To create users, go to Users in the Microsoft Entra admin center, and then click New User.
   
   
6. Select the Basics tab, and then enter the User Principal Name and Display Name, as shown above. 
7. Select the Properties tab, and then enter the first name, last name, and user type, as shown below. 

   

8. Select the Assignments tab.
   
   
9. Click + Add
   
   
    
10. Select the previously created group (here, VIP_Group) or any other relevant group. This ensures the user inherits group-based claims when authenticating using SAML.
11. Click the Select icon.
    
    
12. Click + Add Role. The Directory Roles popup window displays.
13. From the Directory Roles table, select security-related roles as required. For example:
    • Security Reader—Allows read access to security reports
    • Security Administrator—Manages security configuration

    Note: Roles are optional for SAML authentication itself but useful if role claims are mapped into SAML tokens for authorization in downstream applications.

14. Click the Select icon.
15. Click Review and Create, and then confirm the user configuration.

Assign Groups to the SAML Application

Once the group and users are created, assign them to the SAML application so they can authenticate.

1. Go to Enterprise Applications (for example, ACME-ONE-SAML) > Users and Groups.

   
    

2. Click Add User/Group.
   
   
3. Search for the group (for example, VIP_Group), select it, and assign it to the application.
   
   
4. Confirm the assignment. The group appears under the application's Users and Groups tab.

   

5. Click Assign. All members of the assigned group inherit SAML access to the application without needing individual assignments.

   

Configure an Entra ID Authentication Profile

To configure an Entra ID authentication profile in Concerto and then publish the profile to gateways:

1. In Tenant view, select Configure > Security Service Edge > User and Device Authentication > Profiles.

   

2. Click + Add.
   
   
3. Select SAML, then click Get Started.
4. Select ENTRA-ID. The Add SAML Authentication Profile workflow displays.
   
   
5. Collect the following information from Entra:
   • Certificate (Base64)—Download the certificate
   • Login URL
   • Microsoft Entra Identifier/Entity ID
   • Logout URL
     
     To view or download the information from the Microsoft Entra Admin Center, go to Entra ID > Enterprise Apps > All applications > ACME-ONE-SAML > Single sign-on (SAML), as shown in the screen shot below.

   

    

6. In the workflow, enter information for the following fields.

   

   Field	Description
   Single Sign-on URL	Enter the single sign-on URL. For example, https://login.microsoftonline.com/a08ab2d2-a5df-481b-9ffa-bfb7a50a22c4/saml2
   Service Provider Entity ID	Enter the service provider entity ID. For example, https://acme-one-sasegwdiegos-lab.versanow.net/metadata
   Identity Provider Entity ID	Select the entity provider entity ID. For example, https://sts.windows.net/a08ab2d2-a5df-481b-9ffa-bfb7a50a22c4.

   
    
7. To upload the IdP certificate, click +Add New to the right of the Identity Provider Certificate field.

   
   
   The following screen displays.
   
   

8. Enter a CA-Chain Name, then click Upload File. The uploaded file name displays below the Upload file icon.

   

9. Click Add. The certificate information displays beneath the Identity Provider Certificate field.

   

10. Click Next to go to the Users and Groups step.
    
    
11. Select the User Groups tab.
12. Select the group you created in the Okta app (here, VIP_Group).
13. Click Add.
14. Click Next to go to the Review and Submit step. 

    

15. Enter a name and description for the profile, then review all configuration details. 
    
    
16. Click Save to save the profile.
17. Click Publish to publish the profile.

    Note: After creating and publishing the authentication profile, you must apply it to the Secure Access client policy to enforce authentication and apply the corresponding security policies.

Apply the Entra Profile to a Secure Access Rule

To apply the Entra profile to a secure access rule in Concerto:

1. In Tenant view, select Configure > Security Service Edge > Secure Access > Client-Based Access > Policy Rules. 
2. Click + Add to create a new Secure Access client rule, or edit an existing rule. The Add/Edit Client-Based Access Rule workflow displays.
3. Select step 2,  Users & Groups.
   
   
4. Click Customize to specify user-based access rules using the authentication profile you created.
   
   
5. For the User Type field, click Selected Users.
6. For the Enable Rule for the Following Matched Users field, select the authentication profile you configured in section Configure an Entra ID Authentication Profile, above. This allows the policy to enforce access control based on Active Directory group membership.
7. To add specific users or groups to enforce security policies, use the User Groups or Users tabs to select the entries.

   
    

8. Click Skip to Review to go to the Review and Configure workflow step.
9. Review all configuration section, and then click Save to apply the settings to the current Secure Access profile. The Client-Based Access Rules table displays.
10. Click Publish.

Upload the Root CA Certificate to Gateways

Ensure the root CA certificate is uploaded to the gateways from Concerto and reflected correctly on the device.

To upload the root CA certificate to Concerto:

1. In Tenant view, select Configure > Security Service Edge > Settings > Certificates.

   

2. Click +Add. The following screen displays.
   
   
3. Select a certificate type: Cert/Key Bundle, CA Chain, or Private Key.
4. If you selected certificate type Cert/Key Bundle, enter information for the following fields, and then click Add.
    

   Field	Description
   Certificate Name	Enter a name for the certificate.
   CA-Chain Name	Select a CA-Chain from the drop-down list.
   Pass Phrase	Enter a password.

   
    
5. If you selected CA-Chain as the certificate type, enter information for the following fields, and then click Add.
   
   
    

   Field	Description
   CA Chain Name	Enter the CA-chain name,
   Upload File	Click to upload the certificate file.

6. Check that the CA chain (here, device-auth-ca-chain) uploaded successfully and is listed under Configure > Security Service Edge > Settings > Certificates.
   
   

Create the Device Authentication Profile

To configure a device certificate authentication profile in Concerto and then publish the profile to gateways:

1. In Tenant view, select Configure > Security Service Edge > User and Device Authentication > Profiles.

   

2. Click +Add.
   
   
    
3. Select Device Certificate Based as the authentication method, then click Get Started. The Add Device Certificate Authentication Profile workflow displays.
   
   
4. In step 1, Settings, enter information for the following fields:
    

   Field	Description
   Client CA Chain	Select the certificate you uploaded (for example, device-auth-ca-chain.crt).
   Username Identifying Field in Certificate	Select the identifying name. For example, Subject common-name.
   Cache Expiry Time	Enter the cache expiration interval, in minutes. Default: 10 minutes
   Cookie Expiry Time	Cookie expiration interval, in minutes. Default: 720 minutes
   Concurrent Logins	Enter the number of concurrent logins. Default: 1
   Verify with OCSP	Leave disabled unless you require this option.

5. Then click Next to go to workflow step 2, Authentication Order.
   
   

6. Enter information for the following fields.
    

   Field	Description
   Prelogon Device Authentication	Click the toggle to enable or disable pre-logon. When enabled, devices authenticate before user login.
   Device Authentication	Click the toggle to the enabled position (blue), and then select the Device Authentication option to ensure the device authenticates first.

7. Click Next to go to workflow step 3, Review and Submit.
   
   
8. Enter a name and description for the profile.
9. Click Save.
10. Click the Publish icon to publish the profile to gateways.

Install Certificates on the Client Device (Windows)

To download the certificate file onto the client machine (for example, the .pfx file signed by the same CA used for the CA chain upload in the previous section):

1. In Windows, open the Run dialog.
   
   
2. In the Open field, enter the following value: mmc.
3. Press Enter. The MMC console displays.
   
   
4. Go to File > Add/Remove Snap-in. The following screen displays.
   
   
5. Select Certificates, and then click Add.
   
   
    
6. Click Computer Account to manage device-level certificates.
7. Click Next.
   
   
8. Select Local Computer and then click Finish. The following screen displays.
   
   
9. Click OK. The following screen displays.
   
   
10. Right-click the Certificates folder under Personal. Then, in the Actions section, select Certificates > More Actions.
    
    
11. Go to More Actions > All Tasks > Import. The Certificate Import Wizard screen displays.
    
    
     
12. Ensure Local Machine is selected as the store location, and then click Next.
    
    
13. Browse to the certificate file (for example, user1-cert.pfx), select it, and click Open.
    
    
14. In the Password field, enter the certificate's private key password.
15. Make sure the checkbox for Include all extended properties is checked.
16. Optionally, select Mark this key as exportable if you want to reuse it later.
17. Click Next. The Certificate Store screen displays.
    
    
18. On the Certificate Store screen, select Place All Certificates in the Following Store.
19.  Ensure the value is set to Personal, and then click Next.
20. Click Finish to complete the import. A confirmation message should appear: "The import was successful."

    

21. Go to Certificates (Local Computer) > Personal > Certificates. The certificate name should display, as shown below.

    

22. Click the name of the device certificate.
    
    
     
23.  In the Actions section, select More Actions > All Tasks > Manage Private Keys. The following window displays.  

    

24. Ensure the user has access to the private keys assigned at the device level.

Verify Certificates

When a user connects to the gateway and the device certificate authentication profile is enabled, authentication is processed in this order: device first, then user (SSO/LDAP). The user is prompted to choose the correct device certificate. On subsequent connections, the same certificate is auto-selected as long as no other device certificate is installed on the endpoint. If another device certificate is present, the client prompts for selection again.

If certificate validation succeeds, the connection proceeds to the next stage, where the user is authenticated through SAML/SSO or LDAP, depending on configuration. This ensures that both the device and the user identity are verified before access is granted.

The following screenshot displays the SASE client screen allowing certificate selection.

Create a User Authentication Profile

To configure a user certificate authentication profile in Concerto and then publish the profile to gateways:

1. In Tenant view, select Configure > Security Service Edge > User and Device Authentication > Profiles.

   
    

2. Click +Add. The following screen displays.
   
   
3. Select User Certificate Based, and then click Get Started. The Add User Certificate Authentication Profile workflow displays.
   
   
4. Enter information for the following fields.
    

   Field	Description
   Client CA Chain	Select the certificate. Once selected, the certificate details displays below the field.
   Username Identifying Field in Certificate	Select the field that identifies the user in the certificate.
   Cache Expiry Time	Enter the cache expiration time, in minutes. Default: 10
   Cookie Expiration Time	Enter the cookie expiration time, in minutes. Default: 720
   Concurrent Logins	Enter the number of concurrent logins allowed. Default: 1
   Verify with OCSP	This option should be disabled unless verification with OCSP is required.

5. Click Next to go to workflow step 2, Additional Authentication Method.
   
   
6. Click the toggle to enable multi-factor authentication. If you leave this option disabled, only the user certificate is used for authentication. If you enable Multi-factor Authentication, you can select an additional method such as LDAP or SAML.
   
   
    
7. If you enabled multi-factor authentication, select LDAP, and then select which profile to authenticate first: LDAP  Profile or User-Certificate Based Profile.

   
   
    

8. Click Next to go to workflow step 3, Users.

9. In the Users step, you can upload or manually add user entries. This is not mandatory and is only required if you explicitly want to match certificates to specific users. Note: If no users are added, the authentication profile still works without explicit user-to-certificate mapping.
10. Click Next to go to workflow step 4, Review and Submit.
    
    
11. Enter a Name and an optional Description for the profile, and then review the information.
    
    
12. Click Save to save the profile to Concerto.
13. Click Publish to publish the profile to gateways.

Install Certificates on the Client Device

The installation process for user certificates on client devices follows the same procedure described in the device certificate authentication section. The certificate must be imported into the appropriate certificate store on the client machine.