Configure Certificate-Based Authentication for SASE Clients

Generate the CA Key, CA Certificate, and Client Certificate

This section describes how to generate a CA key, CA certificate, and SASE client certificate using OpenSSL on any Linux system. You can create a certificate, get it signed by a CA, and then use it on a Director node. For more information, see Create and Manage Certificates.

You can skip the following steps if you have already generated CA and SASE client certificates or if you use other methods to generate certificates.

To generate a CA key, CA certificate, and SASE client certificate:

1. Generate the root CA key:

   openssl genrsa -aes256 -out root-ca.key 4096
   

2. Generate the CA certificate using the root CA key:

   openssl req -new -x509 -sha256 -days 3650 -key root-ca.key -out root-ca-cert.pem
   

3. Create the cert.conf file with the following values. In the sample configuration here, commonName is alice-cert, which is same as the user name:

   cat cert.conf
   
   #authorityKeyIdentifier = keyid,issuer:always
   distinguished_name = req_distinguished_name
   req_extensions      = v3_req
   x509_extensions = usr_cert
   
   prompt = no
   
   [ req_distinguished_name ]
   countryName = US
   stateOrProvinceName = VA
   localityName = Reston
   organizationName = Versa Networks
   commonName = alice-cert
   
   [ v3_req ]
   extendedKeyUsage = clientAuth, emailProtection
   basicConstraints = CA:FALSE
   keyUsage = critical, digitalSignature, keyEncipherment
   [ usr_cert ]
   basicConstraints = CA:FALSE
   nsCertType = client, email
   nsComment = "OpenSSL Generated Client Certificate"
   keyUsage = critical, digitalSignature, keyEncipherment
   extendedKeyUsage = clientAuth, emailProtection
   subjectKeyIdentifier = hash
   authorityKeyIdentifier = keyid,issuer
   

4. Generate a certificate signing request (CSR) for the client certificate:

   openssl req -out Client.csr -newkey rsa:2048 -nodes -keyout Client-Cert.key -config cert.conf -extensions 'v3_req'
   

5. Generate the client certificate signed by the CA:

   openssl x509 -req -in Client.csr -CA root-ca-cert.pem -CAkey root-ca.key -out Client-Cert.crt -CAcreateserial -days 730 -sha256 -extfile cert.conf -extensions 'usr_cert'
   

6. Convert the .crt file to a .pfx file. Here, we use the name AliceClient-Cert.pfx:

   openssl pkcs12 -inkey Client-Cert.key -in Client-Cert.crt -export -out AliceClient-Cert.pfx -passin pass:password123 -passout pass:password123
   

Import the Client Certificate to a Windows OS Client Device

To import the client certificate that you created in Generate the CA Key, CA Certificate, and Client Certificate, above, to a client device that is running Windows OS:

1. Navigate to where you saved the client certificate, and then double-click it. The Certificate Import Wizard displays.
   
   
2. For certificate-based user authentication, select Current User, or for device authentication, select Local Machine. Here, we select Current User.
3. Click Next.
4. In the File to Import window, click the Browse button, and then select the client certificate file.
   
   
5. Click Next. If the file is password-protected, the Private Key Protection screen displays.
   
   
6. In the password field, enter the name of the password file, and then click Next. The Certificate Store window displays.
   
   
7. Select Place all Certificates in the Following Store option, and then click Browse. The Select Certificate Store popup window displays.
   
   
8. Select Personal, and then click OK.
9. Click Next. The Completing the Certificate Import Wizard window displays.
   
   

10. Click Finish to import the certificate. The certificate displays under Personal > Certificates.
    
    

Import the Client Certificate to an iOS Client Device

Before you import the client certificate that you created in Generate the CA Key, CA Certificate, and Client Certificate, above, on an iOS device, you must download it from your email or from the appropriate server.

To import the client certificate to a client device that is running iOS:

1. To view the downloaded client certificate on your device, go to Settings > Profile Downloaded.
   
   
2. To install the certificate on your device, click Profile Downloaded. The Install Profile window displays the client certificate.
   
   
3. Click Install. The following message displays.
   
   
4. Click Install. The installed certificate displays.
   
   
5. Click Done.

After you import the client certificate, you must trust the certificate so that the registration does not fail. To trust the certificate:

1. Click General > About > Certificate Trust Settings. The Certificate Trust Settings window displays.
   
   
2. In the Enable Full Trust for Root Certificates field, click the toggle for the Versa SASE client certificate, and then click Continue.

To view the client certificate from the SASE client, select Troubleshoot > CA Certificates.

For information about importing the client certificate on a MacOS device, see Import the CA Certificate.

Upload the CA Certificate to the Device

To upload the root CA certificate to the device:

1. In the Director view:
   1. Select the Configuration tab in the top menu bar.
   2. Select Devices > Devices in the horizontal menu bar.
   3. Select an organization in the left menu bar.
   4. Select a Controller or Versa Operating System^TM (VOS^TM) device in the dashboard. The view changes to Appliance view.
2. Select the Configuration tab in the top menu bar.
3. Select Objects & Connectors > Objects > Custom Objects > CA Chains in the left menu bar.
   
   
4. Select the Director tab, and then click Upload File to upload the .crt file. The Upload CA Chain to Director popup window displays.
   
   
5. In the Chain Name field, enter a name for the chain.
6. In the Chain Filename field, enter the name of the chain file to upload, or click Browse to select the file to upload to the Director node.
7. Click OK to upload the file.
8. Select the Appliance tab.
   
   
9. Click Upload File. The Upload CA Chain File to Appliance popup window displays.
   
   
10. In the name field, select the name of the CA chain file (here, rootca-cert.pem) to upload to the VOS device.
11. Click OK to upload the file to the VOS device. The CA chain file displays on the Appliance tab.
    
    

Configure a Certificate Authentication Profile

You configure a certificate authentication profile and use it in an authentication profile.

To configure a certificate authentication profile:

1. In Director view:
   a. Select the Administration tab in the top menu bar.
   b. Select Appliances in the left menu bar.
   c. Select a device name in the main pane. The view changes to Appliance view.
2. Select the Configuration tab in the top menu bar.
3. Select Object and Connectors > Connectors > Users/Groups > Certificate Authentication Profile in the left menu bar.
   
   
4. Click Add. In the Add/Edit Certificate Authentication Profile popup window, enter information for the following fields.
   
   
    

   Field	Description
   Name (Required)	Enter a name for the certificate authentication profile.
   Description	Enter a description for the certificate authentication profile.
   Server Certificate (Required)	Select the server certificate for certificate authentication.
   Server Hostname (Required)	Enter a hostname to start certificate authentication service. Ensure that this fully qualified domain name (FQDN) is different from the FQDN of the SASE gateway.
   Server Port (Required)	Enter the port number to start certificate authentication service. You can enter 443 or any other private port number.
   Client CA Chain (Required)	Select the root CA chain that you uploaded in Upload the CA Certificate to the Device to authenticate the client certificate.
   Routing Instances (Required)	Click theAdd icon and select the routing instance to reach the certificate authentication server.
   Server Addresses	Enter the WAN-VR IP address to start certificate authentication service.
   Username Field	Select the field that the VOS software uses to validate a name match in the client certificate: Alternative-name Email Subject Alternative-name Principal Name Subject Common-nameSubject

5. For more information about the other fields in the Add/Edit Certificate Authentication Profile popup window, see Configure a Certificate Authentication Profile in Configure User and Group Policy.
6. Click OK.

Configure an Authentication Method for Certificate Authentication Profile

To configure an authentication method for the certificate authentication profile you configured in Configure a Certificate Authentication Profile, above:

1. In Director view:
   1. Select the Administration tab in the top menu bar.
   2. Select Appliances in the left menu bar.
   3. Select a device name in the main panel. The view changes to Appliance view.
2. Select the Configuration tab in the top menu bar.
3. Select Object and Connectors > Connectors > Users/Groups > Authentication Methods in the left menu bar.
   
   
4. Click Add. The Add Authentication Methods popup window displays.
   
   
5. Enter a name for the authentication method.
6. Under Authentication Method, select Certificate Authentication Profile in the Method field.
7. In the Certificate Authentication Profile field, select the profile (here, Client-Cert-Auth-Profile) that you created in Configure a Certificate Authentication Profile, above.
8. Click OK.

Associate the Authentication Method with the Authentication Profile

1. In Director view:
   1. Select the Administration tab in the top menu bar.
   2. Select Appliances in the left menu bar.
   3. Select a device name in the main panel. The view changes to Appliance view.
2. Select the Configuration tab in the top menu bar.
3. Select Objects & Connectors > Connectors > Users/Groups > Authentication Profiles in the left menu bar.
   
   
4. Click Add. The Add Authentication Profiles popup window displays.
   
   
5. Enter a name for the authentication profile.
6. In the Default Authentication Method field, click + and then select the authentication method (here, Client-Cert-Auth-Method) that you added in Associate the Certification Authentication Profile with the Authentication Method, above.
7. For information about configuring other parameters, see Configure an Authentication Profile in Configure User and Group Policy.
8. Click OK.

Associate the Authentication Profile with the Secure Access Portal

1. In Director view:
   1. Select the Configuration tab in the top menu bar.
   2. Select Templates > Device Templates in the horizontal menu bar.
   3. Select an organization in the left menu bar.
   4. Select a template in the main pane. The view changes to Appliance view.
2. Select the Configuration tab in the top menu bar.
3. Select Services > Secure Access > Portal > General in the left menu bar.
   
   
4. Click the Edit icon. The Add Services popup window displays.
   
   
5. In the Authentication field, select the certificate authentication profile (here, Client-Cert-Auth-Profile) that you added in Configure a Certificate Authentication Profile, above.
6. For information about configuring other parameters, see Configure a Secure Access Gateway in Configure the Versa Secure Access Service.
7. Click OK.

Associate the Authentication Profile with the Secure Access Gateway

1. In Director view:
   1. Select the Configuration tab in the top menu bar.
   2. Select Templates > Device Templates in the horizontal menu bar.
   3. Select an organization in the left menu bar.
   4. Select a template in the main pane. The view changes to Appliance view.
2. Select the Configuration tab in the top menu bar.
3. Select Services > Secure Access > Gateway > General in the left menu bar.
   
   
4. Click the Edit icon. The Add Services popup window displays.
   
   
5. In the Authentication field, select the certificate authentication profile (here, Client-Cert-Auth-Profile) that you added in Configure a Certificate Authentication Profile above.
6. For information about configuring other parameters, see Configure a Secure Access Portal in Configure the Versa Secure Access Service.
7. Click OK.

Modify the Organization Limit to Associate the Server Hostname with the Domain Name

To modify organization (tenant) limits:

1. In Director view:
   1. Select the Administration tab in the top menu bar.
   2. Select Appliances in the left menu bar.
   3. Select a device name in the main panel. The view changes to Appliance view.
   4. Select an organization.
2. Select the Configuration tab in the top menu bar.
3. Select Others > Organization > Limits in the left menu bar. The main pane displays the organizations associated with the Controller node.
   
   
4. Select the General tab.
   
   
5. In the Domain Names field, click + and then select the host (here, ny-gw1.versa.local) that you added in the Server Hostname field in Configure a Certificate Authentication Profile, above.
6. For information about configuring other parameters, see Configure Organization Limits.
7. Click OK.

Associate Certificate Authentication Profile with Secure Access Portal

1. In Director view:
   1. Select the Configuration tab in the top menu bar.
   2. Select Templates > Device Templates in the horizontal menu bar.
   3. Select an organization in the left menu bar.
   4. Select a template in the main pane. The view changes to Appliance view.
2. Select the Configuration tab in the top menu bar.
3. Select Services > Secure Access > Portal > General in the left menu bar.
   
   
4. Click the Edit icon. The Add Services popup window displays.
   
   
5. In the Device Authentication Profile field, select the certificate authentication profile (here, Client-Cert-Auth-Profile) that you added in Configure a Certificate Authentication Profile, above.
6. In the Authentication Order field, select Device Authentication, and then click the Add icon. The device option displays. Versa SASE supports multifactor authentication, so to authenticate users, also select User Authentication.
7. For information about configuring other parameters, see Configure a Secure Access Gateway in Configure the Versa Secure Access Service.
8. Click OK.

Associate the Certificate Authentication Profile with the Secure Access Gateway

1. In Director view:
   1. Select the Configuration tab in the top menu bar.
   2. Select Templates > Device Templates in the horizontal menu bar.
   3. Select an organization in the left menu bar.
   4. Select a template in the main pane. The view changes to Appliance view.
2. Select the Configuration tab in the top menu bar.
3. Select Services > Secure Access > Gateway > General in the left menu bar.
   
   
4. Click the Edit icon. The Add Services popup window displays.
   
   
5. In the Device Authentication Profile field, select the certificate authentication profile (here, Client-Cert-Auth-Profile) that you added in Configure a Certificate Authentication Profile, above.
6. In the Authentication Order field, select Device Authentication, and then click the Add icon. The device option displays. Versa SASE supports multifactor authentication, so to authenticate users, also select User Authentication.
7. For information about configuring other parameters, see Configure a Secure Access Portal in Configure the Versa Secure Access Service.
8. Click OK.