Using Mutual (Certificate-Based) Authentication

Use the information in this section to understand, create, and use mutual authentication profiles.


How Mutual Authentication Works

Figure 49 illustrates how mutual authentication can be used to control access to proxy services.

Figure 49


Platforms Requirements

The following table summarizes the platform requirements for mutual authentication:


Table 13.

Network Component Software Requirements

Workstation

Any SSL-capable Internet browser

Cache Device

Excelerator 2.1 or later

Certificate Authority Server

The Certificate Authority that issued the Client certificate to the browser

Preparing Your Network for Mutual Authentication

Figure 50 summarizes the configuration requirements for mutual authentication:

Figure 50

NOTE:  If the profile will be used in combination with another profile, make sure the information in each client certificate meets the requirements outlined in Combining Mutual (Certificate-Based) Profiles with Other Profiles.


Setting Up Mutual Authentication

After you have completed the steps in Preparing Your Network for Mutual Authentication, you can set up mutual authentication by completing the instructions in the following sections.


Creating a Mutual Authentication Profile

  1. In the browser-based management tool, click Cache > Authentication > Insert.

  2. Type a name for the profile in the Authentication Profile Name field.

    IMPORTANT:  Each profile name created on a cache device must be unique. Excelerator doesn't recognize case differences (MyProfile and myprofile are the same name to Excelerator) and it will overwrite and concatenate previously created profiles without warning if a duplicate name is used. For more information, see Authentication Dialog Box.

  3. Check Mutual Authentication > click Options.

  4. If the List of Trusted Roots contains the trusted root for the Client certificate the workstations will use, select the trusted root > click Insert.

  5. If the List of Trusted Roots doesn't contain the trusted root for the Client certificate the workstations will use, click Import Trusted Root and import the appropriate trusted root.

    For information on importing trusted root files, see Managing Appliance Certificates, specifically Importing a Trusted Root to a Cache Device.

  6. Click OK > OK.

  7. Assign the profile to one or more proxy services as described in each service tab section in Using the Cache Panel.