ssl vpn certificate

[elite2010]

Hi,

I am using SSL anyconnect vpn . ISE is the authentication server .
Domain users are authenticated based on the security group . And 2FA enabled using an OTP service as second factor

Now I want to remove the 2FA and add certificate as second factor .

As I understand I have to create certificate for the users .

The FQDN of the user is "user1@test.local '

I am facing some issues with Microsoft CA .

So I decided to put Openssl CA ,

So when I create certificate for the user , What are the information must be provided ,Do i need to add the key also to the workstation

Thanks

[Bogdan Nita]

Users only needs a valid certificate from the CA server.

No need to install root certificate on the user device, but should be installed on the ASA in order to properly validate the certificate of the clients.

Common name for the user certificate can be any unique name, but you probably want something that can identify the client using the certificate.

[elite2010]

Hi,
Why do we dont need to install the root on the ca ,Is it because the client is the one who is presenting its certificate to the ASA ?
If the username is 'user1@test.local' ,What could be the CN of the certificate

Thanks

[Marvin Rhoads]

I believe if the user/workstation is presenting a certificate for authentication they must also have the private key for their own certificate.

You can also issue certificates from ISE as a CA. Most common though is to use Microsoft CA. There are several how-to tutorials online covering how to do that.

[elite2010]

Hi,
Is there any document about CA in ISE ? .
Let's say certificate installed on the client .
User trying to connect vpn ,
How the validation process works
Thanks

[Marvin Rhoads]

ISE needs to trust the CA issuing the certificates to the clients. Usually that is done by ensuring that a copy of the CA's root certificate is installed on ISE and trusted.

Once that is in place, a Certificate Authentication Profile needs to be in place to instruct ISE which field (typically CN) to use in the presented certificate to identify / authenticate the user.

There are several resources specific to certificate authentication in ISE. One good overview article is here:

https://www.networkworld.com/article/2226498/infrastructure-management/simply-put-how-does-certificate-based-authentication-work.html

Details on how an ASA interacts with client authentication and ISE can be found here:

https://communities.cisco.com/docs/DOC-68158