Coyote Point Systems E350GX, Installation And Administration Manual

Page: 285 / 344

Enabling HTTPS with Server and Client Certificates
Equalizer Installation and Administration Guide 281
Enabling HTTPS with Server and Client Certificates
The following are the steps to follow to obtain and install both server and client certificates, and verify that they
work.
1. Perform the procedure in the previous section (“Enabling HTTPS with a Server Certificate” on page 280) to
enable HTTPS with a server side certificate.
2. Generate a Client Certificate Signing Request or a Self-Signed Client Certificate.
In Step 1, you created a server certificate. Now, follow the same procedure to generate a client certificate; do
one of the following:
a. Create a Certificate Signing Request (CSR) and send it to a Certificate Authority for signing . See the
section “Generating a CSR and Getting It Signed by a CA” on page 282.
b. Create a certificate and sign it yourself . See the section “Generating a Self-Signed Certificate” on page
283.
Many organizations choose to use third-party signed certificates for their HTTPS clusters, and use self-signed
certificates for their clients.
3. Modify the HTTPS cluster to request a client certificate.
a. Select the HTTPS cluster in the left frame of the Equalizer Administrative Interface and then select the SSL
tab in the right frame.
b. Enable the certify_client flag; this tells Equalizer to request a client certificate when a client attempts to
connect to this cluster.
c. By default, the client certificate verification depth is set to 2. This number indicates the number of levels
in a certificate chain that the Equalizer will process before stopping (and refusing the connection). This
default will need to be raised if you received more than one chained root certificate in addition to a client
certificate from your Certificate Authority. Note that this setting has an impact on performance, since SSL
operations are resource intensive.
d. By default, Equalizer requests a client certificate, but does not require the client to provide one. Enable the
require certificate flag to require that a client return a valid certificate before connecting.
e. By default, the client’s certificate will be re-validated if the SSL connection needs to be renegotiated.
(Renegotiation is a feature of SSL, can occur for any of a number of reasons, and may be initiated by
Equalizer or the client browser.) Enable the
verify once flag to tell Equalizer not to re-evaluate the client
certificate even if SSL renegotiation occurs. This can have a positive performance impact if many SSL
renegotiations are occurring during normal operations.
f. Select commit to save your changes to the cluster definition.
For more information on SSL parameters, see the section “Layer 7 Security > SSL Tab (HTTPS only)” on page
120.
4. Install the Client Certificate on Equalizer.
Use the Equalizer Administration Interface to install the client certificate. See the section “Installing Certificates
for an HTTPS Cluster” on page 284.
5. Install the Client Certificate on all clients.
Import the client certificate into the client browser’s list of certificates. On Firefox, open Tools > Options >
Advanced > View Certificates . On Internet Explorer, open Tools > Internet Options > Content >
Certificates . Refer to the documentation for your browser for instructions.
6. Try connecting to the Cluster via HTTPS.
From a client browser, open https:// cluster , where cluster is the network node name or IP address of the
HTTPS cluster. The browser may notify you that it is accepting a certificate from the server and ask for