Configuring user authentication using digital certificates or smart cards
You can configure Access Appliance to authenticate users with a smart card or a digital certificate. After configuration, the users can use the option to sign in to Access Appliance UI using smart cards or digital certificates.
Before you configure user authentication using smart cards or digital certificates, note the following:
Ensure that LDAP is configured. Go to and click to configure LDAP, if not already done so. For details about how to configure LDAP:
Smart card authentication can be configured only for LDAP users.
Smart card authentication requires a list of trusted root or intermediate CA certificates. You must add the CA certificates that are associated with the user digital certificates or the user smart cards.
To configure Access Appliance to authenticate users with a certificate or smart card:
- Log in to Access Appliance UI.
- In the left navigation pane, click Settings > Security management, and then click Smart card authentication.
- Use the slider to turn on smart card authentication.
- In the Configure smart card authentication dialog box, specify the following options:
In the User authentication domain list, select the configured LDAP server.
Click Common name to select the common mapping attribute.
Optionally, enter the Online Certificate Status Protocol (OCSP) URI. OSCP is used for checking the validity of the certificate.
If you do not provide the OCSP URI, the URI in the user certificate is used.
- Click Save.
- To the right of CA certificates click Add.
- Click Browse to select the CA certificate or drag and drop the CA certificate and click Add.
Certificates must be in PEM format, with certificate file type as
.pem. Only one certificate can be added at a time. The web server is restarted after adding the certificate.The selected CA certificate is displayed under CA certificates.
- Upload the client certificate to the browser's certificate store. See the browser documentation for importing client certificates.
The users can now use the option to sign in to the Access Appliance UI. LDAP users with Appliance administrator role have access to all settings in the UI. LDAP users that do not have this role, can only create S3 keys.