Product Documentation
Gateway
Current Release 13.1 13.0 12.1
View PDF

Configure client certificate or client certificate and domain authentication

January 8, 2024
Contributed by: 
C

You can use the NetScaler for Citrix Endpoint Management wizard to perform the configuration required for Citrix Endpoint Management when using NetScaler certificate-only authentication or certificate plus domain authentication. You can run the NetScaler for Citrix Endpoint Management wizard one time only. For information about using the wizard, see Configuring Settings for Your Citrix Endpoint Management Environment.

If you’ve already used the wizard, use the instructions in this article for the addition configuration required for client certificate authentication or client certificate plus domain authentication.

To ensure that the user of a device in MAM-only mode can’t authenticate using an existing certificate on the device, see “NetScaler Certificate Revocation List (CRL)” later in this article.

Configure NetScaler Gateway for client certificate authentication by using the GUI

  1. Navigate to Traffic Management > Load Balancing > Virtual Servers.

  2. Select the virtual server of type SSL, and in the SSL Parameters section set Enable Session Reuse as DISABLED.

  3. Navigate to NetScaler Gateway > Virtual Servers.
  4. Select the virtual server of type SSL, and click Edit.
  5. In the SSL Parameters section, click the edit icon.

  6. Select Client Authentication and in Client Certificate, select Mandatory.

  7. Create an authentication certificate policy so Citrix Endpoint Management can extract the User Principal Name or the sAMAccount from the client certificate provided by Secure Hub to NetScaler Gateway.

  8. Navigate to NetScaler Gateway> Policies> Authentication > CERT.

  9. Click the Profiles tab and click Add.

  10. Set the following parameters for the certificate profile:

    Authentication Type: CERT

    Two Factor: OFF (for certificate only authentication)

    User Name Field: Subject: CN

    Group Name Field: SubjectAltName:PrincipalName

  11. Bind only the certificate authentication policy as the Primary Authentication in the NetScaler Gateway virtual server.

  12. Bind the Root CA certificate to validate the trust of the client certificate presented to NetScaler Gateway.

Configure NetScaler Gateway for client certificate and domain authentication by using the GUI

  1. Navigate to Traffic Management > Load Balancing > Virtual Servers.

  2. Select the virtual server of type SSL, and in the SSL Parameters section set Enable Session Reuse as DISABLED.

  3. Go to NetScaler Gateway > Policies > Authentication > Cert.

  4. Click the Profiles tab, click Add.

  5. Enter the Name of the profile, set Two Factor to ON, and from User Name Field, select SubjectAltNamePrincipalName.

  6. Click the Policies tab and click Add.

  7. Enter the Name of the policy, from Server select the certificate profile, set the Expression and click Create.

  8. Go to Virtual Servers, select the virtual server of type SSL, and click Edit.

  9. Beside Authentication, click + to add the certificate authentication.

  10. To select the authentication method, in Choose Policy, select Certificate, and in Choose Type select Primary. This binds certificate authentication as the primary authentication with the same priority as the LDAP authentication type.

  11. Under Policy Binding, click Click to Select to select the certificate policy created earlier.

  12. Select the certificate policy created earlier and click OK.

  13. Set the Priority to 100 and then click Bind. Use the same priority number when you configure the LDAP authentication policy in the subsequent steps.

  14. On the row for LDAP Policy, click >.

  15. Select the policy and then, from the Edit drop-down menu, click Edit Binding.

  16. Enter the same Priority value that you specified for the certificate policy. Click Bind.

  17. Click Close.

  18. Click the edit icon in the SSL Parameters section.

  19. Select the Client Authentication checkbox, and in Client Certificate choose Mandatory, and click OK.

  20. Click Done.

NetScaler Certificate Revocation List (CRL)

Citrix Endpoint Management supports Certificate Revocation List (CRL) only for a third party Certificate Authority. If you have a Microsoft CA configured, Citrix Endpoint Management uses NetScaler to manage revocation. When you configure client certificate-based authentication, consider whether you need to configure the NetScaler Certificate Revocation List (CRL) setting, Enable CRL Auto Refresh. This step ensures that the user of a device in MAM-only mode can’t authenticate using an existing certificate on the device. Citrix Endpoint Management reissues a new certificate, because it doesn’t restrict a user from generating a user certificate if one is revoked. This setting increases the security of PKI entities when the CRL checks for expired PKI entities.

Configure client certificate or client certificate and domain authentication
January 8, 2024
Contributed by: 
C
January 8, 2024
Contributed by: 
C

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.