F5 FirePass, Administrator'S Manual

Page: 77 / 182

Setting Up FirePass Server Security
FirePass
™
Server Administrator Guide 3 - 31
11. Unzip the zip file and send the certificate request file (called
newcert.csr) to a known Certificate Authority to be signed. When
asked by the Certificate authority, specify the type of the certificate
as mod_ssl.
Installing or renewing a server certificate
When you receive a new signed certificate from the Certificate Authority,
you must install the certificate and, if you requested one, the new private
key.
To install or renew a server certificate
1. Under the Server tab on the left side of the Administrative Console,
click the Maintenance link.
2. Navigate to Network Configuration/Web Services.
Click the Configure SSL Certificates link.
3. Select the certificate you want to renew and click the Edit link, or
click the Add New Certificate button.
4. Copy the new signed certificate to the clipboard and then paste into
the upper text box.
5. If you generated a new key, paste it into the middle text box, and
then enter the encryption password you specified when you
generated the certificate request.
6. If your certificate comes from a chained Certificate Authority, paste
the intermediate certificate chain in the lower text box.
7. Click the Go button.
Using client certificates to authenticate a user’s computer
The server certificate verifies the server’s identity to a user’s computer. You
also can require client certificates verifying the identity of a user’s computer
to the server, or limiting access to particular FirePass Webifyers. Client
certificates can be used as part of a two-factor authentication system, where
users must have a valid client certificate installed on their computer in
addition to knowing their user name and password. Alternatively, valid
client certificates can be used to restrict access to particular Webifyers. For
example, access to the FirePass server SSL VPN service can be limited to a
laptop computer equipped with a valid client certificate. The user then
would have access to the SSL VPN service from the laptop, but would not
have access from other locations such as public access kiosks.
To use client certificates, you must have a server configured as a Certificate
Authority (CA) that can generate a client root certificate and the client
certificates based on the client root certificate. Or, you can purchase the
client root certificate and client certificates from an external CA.