SPP 7.5.1 On Demand - Certificate Authentication

Hi Derrick,

Does the Certificate authentication work if you configure the user with a different Certificate that does not require a PIN as a comparison?

Is the Root CA certificate and any intermediate certs in the chain added to Appliance Management > Certificates > Trusted CA Certificates

Does the Certificate include Certificate Revocation List (CDP) extensions, if so which ones?

Thanks!

Hi Tawfiq, the Root CA cert and intermediate certs are added in the Trusted CA Certificates.

Will try to test out a different certificate that doesn't require a PIN. But just a heads up that our use case requires us to use the cert that requires a PIN.

Also, will check if it contains a CDP.

Hi Tawfiq, just wanted to ask how the Certification Revocation List would affect the Certificate Authentication?

Hi Derrick,

If the certificates include CRL Distribution Points and these CRLs are unavailable or User Certificate is revoked or expired then user would *not* be able to login and gets access is denied error.

Thanks!

Thanks Tawfiq. I got confirmation that using a certificate with no PIN allowed the user to login. Considering this, do you have any recommendation on what we can look at to allow the certificate with PIN to work?

What steps did you take to add a PIN to the certificate?

Does this issue happen to any certificate which you have created with a PIN?

Hi Tawfiq, will check that out. But wanted to mention that although it worked when used with a local Safeguard account, it doesn't work when using an account imported from AD. When you try to use the certificate with no PIN for those accounts, the error is “Could not map certificate to an Active Directory user account.”

For AD Users, the authentication tab has this option enabled Require Certificate Authentication