Configure client certificate or client certificate and domain authentication
You can use the Citrix ADC for Citrix Endpoint Management wizard to perform the configuration required for Citrix Endpoint Management when using Citrix ADC certificate-only authentication or certificate plus domain authentication. You can run the Citrix ADC for Citrix Endpoint Management wizard one time only. For information about using the wizard, seeConfiguring Settings for Your Citrix Endpoint Management Environment.
If you’ve already used the wizard, use the instructions in this article for the addition configuration required for client certificate authentication or client certificate plus domain authentication.
To ensure that the user of a device in MAM-only mode can’t authenticate using an existing certificate on the device, see “Citrix ADC Certificate Revocation List (CRL)” later in this article.
Configure Citrix Gateway for client certificate authentication by using the GUI
- Navigate toTraffic Management > Load Balancing > Virtual Servers.
Select the virtual server of typeSSL, and in theSSL Parameterssection setEnable Session ReuseasDISABLED.
- Navigate toCitrix Gateway > Virtual Servers.
- Select the virtual server of typeSSL, and clickEdit.
- In theSSL Parameterssection, click the edit icon.
SelectClient Authenticationand inClient Certificate, selectMandatory.
Create an authentication certificate policy so Citrix Endpoint Management can extract theUser Principal Nameor thesAMAccountfrom the client certificate provided by Secure Hub to Citrix Gateway.
Navigate toCitrix Gateway> Policies> Authentication > CERT.
Click theProfilestab and clickAdd.
Set the following parameters for the certificate profile:
Authentication Type:CERT
Two Factor:OFF(for certificate only authentication)
User Name Field: Subject:CN
Group Name Field:SubjectAltName:PrincipalName
Bind only the certificate authentication policy as thePrimary Authenticationin the Citrix Gateway virtual server.
- Bind the Root CA certificate to validate the trust of the client certificate presented to Citrix Gateway.
Configure Citrix Gateway for client certificate and domain authentication by using the GUI
- Navigate toTraffic Management > Load Balancing > Virtual Servers.
Select the virtual server of typeSSL, and in theSSL Parameterssection setEnable Session ReuseasDISABLED.
Go toCitrix Gateway > Policies > Authentication > Cert.
Click theProfilestab , clickAdd.
Enter theNameof the profile, setTwo FactortoON, and fromUser Name Field, selectSubjectAltNamePrincipalName.
Click thePoliciestab and clickAdd.
Enter theNameof the policy, from爵士verselect the certificate profile, set theExpressionand clickCreate.
Go toVirtual Servers, select the virtual server of typeSSL, and clickEdit.
BesideAuthentication, click+to add the certificate authentication.
To select the authentication method,InChoose Policy, selectCertificate, and inChoose TypeselectPrimary. This binds certificate authentication as the primary authentication with the priority same as the LDAP authentication type.
UnderPolicy Binding, clickClick to Selectto select the certificate policy created earlier.
Select the certificate policy created earlier and clickOK.
Set thePriorityto100and then clickBind. Use the same priority number when you configure the LDAP authentication policy in the subsequent steps.
On the row forLDAP Policy, click>.
Select the policy and then, from theEditdrop-down menu, clickEdit Binding.
Enter the samePriorityvalue that you specified for the certificate policy. ClickBind.
ClickClose.
Click the edit icon inSSL Parameterssection.
Select theClient Authenticationcheck box, and inClient CertificatechooseMandatory, and clickOK.
ClickDone.
Citrix ADC Certificate Revocation List (CRL)
Citrix Endpoint Management supports Certificate Revocation List (CRL) only for a third party Certificate Authority. If you have a Microsoft CA configured, Citrix Endpoint Management uses Citrix ADC to manage revocation. When you configure client certificate-based authentication, consider whether you need to configure the Citrix ADC Certificate Revocation List (CRL) setting,Enable CRL Auto Refresh. This step ensures that the user of a device in MAM-only mode can’t authenticate using an existing certificate on the device. Citrix Endpoint Management reissues a new certificate, because it doesn’t restrict a user from generating a user certificate if one is revoked. This setting increases the security of PKI entities when the CRL checks for expired PKI entities.