Citrix SD-WAN

Certificate authentication

March 12, 2021

Contributed by:

S C

Citrix SD-WAN ensures secure paths are established between appliances in the SD-WAN network by using security techniques such as network encryption and virtual path IPsec tunnels. In addition to the existing security measures, certificate based authentication is introduced in Citrix SD-WAN 11.0.2.

Certificate authentication, allows organizations to use certificates issued by their private Certificate Authority (CA) to authenticate appliances. The appliances are authenticated before establishing the virtual paths. For example, if a branch appliance tries to connect to the data center and the certificate from the branch does not match with the certificate that the data center expects, the virtual path is not established.

The certificate issued by the CA binds a public key to the name of the appliance. The public key works with the corresponding private key possessed by the appliance identified by the certificate.

To enable appliance authentication, in the configuration editor, navigate to Global > Network Settings and select Enable Appliance Authentication.

Enable appliance authentication

After the configuration is staged and applied, a new Certificate Authentication option is listed under Configuration > Virtual WAN.

You can manage all the certificates used for virtual path authentication from the Certificate Authentication page.

Certificate authentication

Note

If you are upgrading the appliance software from SD-WAN version 11.0 to version 11.1, uncheck the Enable Appliance Authentication option and perform the software upgrade. Once the upgrade process is completed, select the Enable Appliance Authentication option.

Installed certificate

The Installed Certificate section provides a summary of the certificate that is installed on the appliance. The appliance uses this certificate to identify itself in the network.

The Issued to section provides details about who the certificate was issues to. The Common Name in the certificate matches with the name of the appliance, since the certificate is bound to the appliance name. The Issuer section provides the details of the certificate signing authority, who signed the certificate. The Certificate details include the fingerprint of the certificate, serial number, and the validity period for the certificate.

Installed certificate

Upload identity bundle

The Identity bundle includes a private key and the certificate associated with the private key. You can upload the appliance certificate issued by the CA into the appliance. The certificate bundle is a PKCS 12 file, with .p12 extension. You can choose to protect it with a password. If you leave the password field blank it is treated as no password protection.

Upload identity bundle

Upload certificate authority bundle

Upload the PKCS 12 bundle that corresponds to the certificate signing authority. The certificate authority bundle includes the complete chain of signatures, the root and all the intermediate signatory authority.

Upload ca bundle

Upload network certificates

Create certification signing request

The appliance can generate an unsigned certificated and create a Certificate Signing Request (CSR). The CA can then download the CSR from the appliance, sign it and upload it back to the appliance in PEM or DER formats. This is used as an Identity certificate for the appliance. To create a CSR for an appliance, provide the appliance common name, organization details, and address.

Certificate signing request

Certificate revocation list manager

A Certificate Revocation List (CRL) is a published list of certificate serial numbers that are no longer valid in the network. The CRL file is periodically downloaded and stored locally on all the appliance. When a certificate is being authenticated the responder examines the CRL to see if the initiators certificate was revoked already. Citrix SD-WAN currently supports version 1 CRLs in PEM and DER format.

To enable CRL, select the CRL enabled option. Provide the location where the CRL file is maintained. HTTP, HTTPS, and FTP locations are supported. Specify the time interval to check and download the CRL file, the range is 1–1440 minutes.

Certificate revocation list

Note

The reauthentication period for a virtua1 path can be between 10–15 minutes, if the CRL update interval is set to a shorter duration, the updated CRL list may include a currently active serial number. Making an actively revoked certificate available in your network for a short duration.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Certificate authentication

March 12, 2021

Contributed by:

S C

March 12, 2021

Contributed by:

S C

Certificate authentication

Installed certificate

Upload identity bundle

Upload certificate authority bundle

Create certification signing request

Certificate revocation list manager

In this article