Forum Discussion

gd-29's avatar
gd-29
Brass Contributor
Aug 12, 2019

Valid Client Certificate Setup

How do you get valid client certificate to work?  What i have so far.  1. CA with Intermediate, User Certificate Template cloned for this purpose 2. Issued a cert to my domain desktop and IOS devi...
Cloud App Security
rodrigobe's avatar
rodrigobe
Copper Contributor
Apr 16, 2020

gd-29 Did you get any feedback on this? I have the exactly same issue.

 

rajatm's avatar
rajatm
Copper Contributor
Apr 20, 2020

rodrigobe are you importing the cert on the client in the current user's personal store? that's where the cert needs to be on the machine and it also needs to have a private key. Once you have configured a session/access policy to check for a valid client cert, you should be prompted to select one from this store when you browse to app you configured in the policy

 

  • rodrigobe's avatar
    rodrigobe
    Copper Contributor
    Apr 22, 2020
    Thank you for your reply!
    I was trying to use a certificate in local machine, not in the current user. Now I changed the CA certificate for the one that I have on my current user and it's working!

    Thanks again.
    • gd-29's avatar
      gd-29
      Brass Contributor
      Apr 22, 2020

      thats a great find. and a cert location we rarely use. 

      i need to re-test now. 

       

      my second pain point with conditional access was getting it to work with native apps on mobile/IOS.

      you seemed to be at the mercy of the app developer to support certificates.

       

      • rajatm's avatar
        rajatm
        Copper Contributor
        Apr 22, 2020
        unfortunately that's correct. some apps are just not designed to honor a cert check. no way to control their access with cert based identification.
  • ataviste's avatar
    ataviste
    Copper Contributor
    Apr 21, 2020
    Hi, I added the client certificate's PFX to the Current User Cert Store (in Personal Certifcates), and the cert is still not accepted by MCAS as a valid client certifcate.
    • rajatm's avatar
      rajatm
      Copper Contributor
      Apr 21, 2020

      ataviste do you have the private key for this cert? and what is the listed usage for this cert?

       

       

      • ataviste's avatar
        ataviste
        Copper Contributor
        Apr 21, 2020

        Hi,

        Yes I imported a PFX, and the "You have a private key that corresponds to this certifcate" message is present.

        The cert usage is client authentication.

  • ataviste's avatar
    ataviste
    Copper Contributor
    Apr 21, 2020

    Hello,

     

    Sorry to resurrect this thread.

     

    I'm also trying to get a client-certificate based condtional access session policy to work in MCAS.

     

    I can get the browser to prompt for the certificate I issued, but it never accepts it and access is always blocked. I'm sure the issuing CA chain is correct and configured in MCAS, but MCAS just doesn't like any certificate I issue from the CA.

     

    Has anybody managed to get this to work?

     

    Thanks,

    Antony

    • gd-29's avatar
      gd-29
      Brass Contributor
      Apr 21, 2020

      ataviste did you try just the root CA or a combination of root and intermediate uploaded?

      i forgot what was recommended by support when i was trying.

      • ataviste's avatar
        ataviste
        Copper Contributor
        Apr 21, 2020

        gd-29 

         

        Hi,

         

        I uploaded the root and intermediate CA as two separate PEM files in MCAS

Resources