topic Re: Secure Domain Logon with certificate based authentication in SASE and Remote Access

Secure Domain Logon with certificate based authentication

Kilian_Huber — Thu, 02 Mar 2023 13:35:09 GMT

Hi CheckMates,

when trying to use Secure Domain Logon with certificate based authentication (E86.26 client), the Secure Domain Logon dialogue does not offer any certificate to be chosen as shown in the screenshot below:

The user certificate store contains a certificate for the user which should be authenticated and the computer certificate store contains a machine certificate.

When skipping SDL and logging in with cached credentials, and then manually establishing a VPN connection, the user's certificate is correctly fetched via CAPI and certificate authentication is successful.

Any idea on how to troubleshoot why no certificate is available in the SDL authentication dialogue?

Thanks!

Re: Secure Domain Logon with certificate based authentication

G_W_Albrecht — Thu, 02 Mar 2023 13:47:21 GMT

Is this an EPS client with TP blades ? sk146712

Re: Secure Domain Logon with certificate based authentication

Kilian_Huber — Thu, 02 Mar 2023 13:52:07 GMT

It is an Endpoint Security Client, yes, but the FDE blade is not installed.

Re: Secure Domain Logon with certificate based authentication

PhoneBoy — Thu, 02 Mar 2023 13:55:35 GMT

I don’t believe SDL is necessary for this.
See: https://community.checkpoint.com/t5/Remote-Access-VPN/How-to-Have-Remote-Access-VPN-Tunnel-Before-User-is-Logged-In/m-p/173047

Re: Secure Domain Logon with certificate based authentication

G_W_Albrecht — Thu, 02 Mar 2023 14:36:08 GMT

So i would suggest TAC...

Re: Secure Domain Logon with certificate based authentication

Kilian_Huber — Thu, 02 Mar 2023 14:44:02 GMT

The machine certificate was just a test to see if I could select this certificate from the drop down list on the SDL window since I don't see the user certificate either. I do not actually want to use machine based authentication; all endpoints already have a user certificates rolled out and this should be used for authentication. IMHO this should be working since the user authenticates to Windows before the SDL window appears, therefore the personal certificate store should be accessible.

Re: Secure Domain Logon with certificate based authentication

PhoneBoy — Thu, 02 Mar 2023 20:30:00 GMT

CAPI certificates cannot be used for SDL.
This is in the documentation: https://sc1.checkpoint.com/documents/RemoteAccessClients_forWindows_AdminGuide/Content/Topics-RA-VPN-for-Win/SDL-for-SmartConsole-Managed-Clients.htm

Re: Secure Domain Logon with certificate based authentication

Kilian_Huber — Thu, 02 Mar 2023 20:42:50 GMT

Ouch, I missed this. Thanks a lot!