Coyote Point Systems Equalizer GX Series, Administration Manual

Page: 818 / 866

Using Certificates in HTTPS Clusters
Enabling HTTPS with Server and Client Certificates
The following are the steps to follow to obtain and install both server and client certificates, and
verify that they work.
1. Perform the procedure in the previous section to enable HTTPS with a server side cer-
tificate.
2. Generate a Client Certificate Signing Request or a Self-Signed Client Certificate.
In Step 1, you created a server certificate. Now, follow the same procedure to generate a
client certificate; do one of the following:
a. Create a Certificate Signing Request (CSR) and send it to a Certificate Authority
for signing. See
"Generating a CSR and Getting It Signed by a CA"
on page 820.
b. Create a certificate and sign it yourself. see
"Generating a Self-Signed Certificate"
on
page 822.
Many organizations choose to use third-party signed certificates for their HTTPS
clusters, and use self-signed certificates for their clients.
3. Modify the HTTPS cluster to request a client certificate.
a. Select the HTTPS cluster in the left navigational pane on the GUI and then select
the SSL tab in the right pane.
b. Enable the
Require Client Certificate
flag; this tells Equalizer to request a client cer-
tificate when a client attempts to connect to this cluster.
c. By default, the client certificate verification depth is set to 2. This number indic-
ates the number of levels in a certificate chain that the Equalizer will process
before stopping verification. This default depth may need to be raised if you
received more than one chained root certificate in addition to a client certificate
from your Certificate Authority. Note that this setting has an impact on per-
formance, since SSL operations are resource-intensive.
d. By default, Equalizer requests a client certificate, but does not require the client
to provide one. Enable the require certificate flag to require that a client return
a valid certificate before connecting.
e. By default, the client’s certificate will be re-validated if the SSL connection
needs to be renegotiated. (Renegotiation is a feature of SSL, can occur for any
of a number of reasons, and may be initiated by Equalizer or the client
browser.) Enable the verify once flag to tell Equalizer not to re-evaluate the cli-
ent certificate even if SSL renegotiation occurs. This can have a positive per-
formance impact if many SSL renegotiation is occurring during normal
operations.
f. Select
Commit
to save your changes to the cluster definition.
For more information on SSL parameters, see the section
"Layer 7 SSL Security (HTTPS
Clusters)"
on page 349
818 Copyright © 2014 Coyote Point Systems, A Subsidiary of Fortinet, Inc.