Valid Client Certificate Setup

[gd-29]

How do you get valid client certificate to work? 

What i have so far. 

1. CA with Intermediate, User Certificate Template cloned for this purpose

2. Issued a cert to my domain desktop and IOS device

3. Enabled a conditional access policy for custom MCAS policy

4. Root and intermediate cert upload to MCAS

5. MCAS policy to block if there is no valid client certificate. 

the block works, i get the "test block" message. but i can't get the client certificate prompt or figure out why it won't prompt for certificate.

My end goal is to test valid client certificate against a few 3rd party IOS apps where device certificate/standard device compliance checkbox doesn't work in conditional access. 

[#2]

Thank you for your reply!
I was trying to use a certificate in local machine, not in the current user. Now I changed the CA certificate for the one that I have on my current user and it's working!

Thanks again.

[#3]

thats a great find. and a cert location we rarely use. 

i need to re-test now. 

my second pain point with conditional access was getting it to work with native apps on mobile/IOS.

you seemed to be at the mercy of the app developer to support certificates.

[#4]

unfortunately that's correct. some apps are just not designed to honor a cert check. no way to control their access with cert based identification.

[#5]

can this be a private certificate ?

[#6]

yes, i'm using an internal CA.
the problem with internal CA is revocation, unless you publish your crl to the internet. if you had to revoke without a published crl, you would have to pull the root cert and remove access for everyone.

[#7]

WIll this work with a public certificate from someone like godaddy or entrust, or do i have to use a internal or managed PKI solution like SecureW2? My mac devices are not domain joined in any way, so my understanding is internal would not work