Product documentation
Citrix Gateway
Current Release 13.0 12.1
View PDF

Configure client certificate or client certificate and domain authentication

July 7, 2021
Contributed by: 
C

You can use the Citrix ADC for Citrix Endpoint Management wizard to perform the configuration required for Citrix Endpoint Management when using Citrix ADC certificate-only authentication or certificate plus domain authentication. You can run the Citrix ADC for Citrix Endpoint Management wizard one time only. For information about using the wizard, see Configuring Settings for Your Citrix Endpoint Management Environment.

If you’ve already used the wizard, use the instructions in this article for the addition configuration required for client certificate authentication or client certificate plus domain authentication.

To ensure that the user of a device in MAM-only mode can’t authenticate using an existing certificate on the device, see “Citrix ADC Certificate Revocation List (CRL)” later in this article.

Configure Citrix Gateway for client certificate authentication by using the GUI

  1. Navigate to Traffic Management > Load Balancing > Virtual Servers.

  2. Select the virtual server of type SSL, and in the SSL Parameters section set Enable Session Reuse as DISABLED.

    SSL parameters page

  3. Navigate to Citrix Gateway > Virtual Servers.
  4. Select the virtual server of type SSL, and click Edit.
  5. In the SSL Parameters section, click the edit icon.

  6. Select Client Authentication and in Client Certificate, select Mandatory.

    SSL parameter details

  7. Create an authentication certificate policy so Citrix Endpoint Management can extract the User Principal Name or the sAMAccount from the client certificate provided by Secure Hub to Citrix Gateway.

  8. Navigate to Citrix Gateway> Policies> Authentication > CERT.

  9. Click the Profiles tab and click Add.

  10. Set the following parameters for the certificate profile:

    Authentication Type: CERT

    Two Factor: OFF (for certificate only authentication)

    User Name Field: Subject: CN

    Group Name Field: SubjectAltName:PrincipalName

    Profile details

  11. Bind only the certificate authentication policy as the Primary Authentication in the Citrix Gateway virtual server.

    Binding the policy

  12. Bind the Root CA certificate to validate the trust of the client certificate presented to Citrix Gateway.

Configure Citrix Gateway for client certificate and domain authentication by using the GUI

  1. Navigate to Traffic Management > Load Balancing > Virtual Servers.

  2. Select the virtual server of type SSL, and in the SSL Parameters section set Enable Session Reuse as DISABLED.

    SSL parameters page

  3. Go to Citrix Gateway > Policies > Authentication > Cert.

  4. Click the Profiles tab , click Add.

    Click to add a certificate server

  5. Enter the Name of the profile, set Two Factor to ON, and from User Name Field, select SubjectAltNamePrincipalName.

    Certificate server details

  6. Click the Policies tab and click Add.

  7. Enter the Name of the policy, from Server select the certificate profile, set the Expression and click Create.

    Enter the expression

  8. Go to Virtual Servers, select the virtual server of type SSL, and click Edit.

  9. Beside Authentication, click + to add the certificate authentication.

  10. To select the authentication method,In Choose Policy, select Certificate, and in Choose Type select Primary. This binds certificate authentication as the primary authentication with the priority same as the LDAP authentication type.

    Primary authentication type

  11. Under Policy Binding, click Click to Select to select the certificate policy created earlier.

  12. Select the certificate policy created earlier and click OK.

  13. Set the Priority to 100 and then click Bind. Use the same priority number when you configure the LDAP authentication policy in the subsequent steps.

    Select priority

  14. On the row for LDAP Policy, click >.

  15. Select the policy and then, from the Edit drop-down menu, click Edit Binding.

  16. Enter the same Priority value that you specified for the certificate policy. Click Bind.

    Enter the same priority

  17. Click Close.

    Binding complete

  18. Click the edit icon in SSL Parameters section.

  19. Select the Client Authentication check box, and in Client Certificate choose Mandatory, and click OK.

    Make client certificate mandatory

  20. Click Done.

    Configuration complete

Citrix ADC Certificate Revocation List (CRL)

Citrix Endpoint Management supports Certificate Revocation List (CRL) only for a third party Certificate Authority. If you have a Microsoft CA configured, Citrix Endpoint Management uses Citrix ADC to manage revocation. When you configure client certificate-based authentication, consider whether you need to configure the Citrix ADC Certificate Revocation List (CRL) setting, Enable CRL Auto Refresh. This step ensures that the user of a device in MAM-only mode can’t authenticate using an existing certificate on the device. Citrix Endpoint Management reissues a new certificate, because it doesn’t restrict a user from generating a user certificate if one is revoked. This setting increases the security of PKI entities when the CRL checks for expired PKI entities.

Configure client certificate or client certificate and domain authentication
July 7, 2021
Contributed by: 
C
July 7, 2021
Contributed by: 
C

In this article

Site feedback | Privacy and legal terms | Cookie preferences | Consent settings
© 1999- Cloud Software Group, Inc. All rights reserved.