topic R80.40 Mobile Access / Capsule Connect with Password + Certificate in SASE and Remote Access

R80.40 Mobile Access / Capsule Connect with Password + Certificate

mschlumpberger — Mon, 14 Dec 2020 13:12:14 GMT

Hi everybody,

we want to setup MOB for Remote-Access for Capsule-Connect via Password + Certificate.

We want to use Certificates, which are already installed on the iphones via MDM. Is it possible to use this Certificates for VPN, too?

If we test it with a certificate from Checkpoint (Client Certificates) everything is working.

Someone succesfully test this setup earlier?

Best regards

Marco

Re: R80.40 Mobile Access / Capsule Connect with Password + Certificate

mschlumpberger — Mon, 14 Dec 2020 14:06:21 GMT

Additional Information:

We get on our iphones the error: malformed reply from Site

Re: R80.40 Mobile Access / Capsule Connect with Password + Certificate

G_W_Albrecht — Mon, 14 Dec 2020 14:44:30 GMT

I can only find sk131772: VPN clients cannot connect or create site to the gateway

Re: R80.40 Mobile Access / Capsule Connect with Password + Certificate

mschlumpberger — Mon, 14 Dec 2020 15:19:36 GMT

Hi,

thank you for your feedback. I found that sk, too.

But this is not our solution and if i am using "normal" certificates from checkpoint (Client-Certificates) everything is working.

best regards

Re: R80.40 Mobile Access / Capsule Connect with Password + Certificate

PhoneBoy — Tue, 15 Dec 2020 04:00:31 GMT

Have you defined the CA of the MDM certificates in the configuration?
This means creating specific type of object and configuring the gateway to trust certificates from that CA.

Re: R80.40 Mobile Access / Capsule Connect with Password + Certificate

mschlumpberger — Wed, 16 Dec 2020 13:04:35 GMT

Hi,

thank you for your feedback. Yes I configured the CA as a Trusted-CA in SmartConsole.

In my vpn debug I can see that my certificate is trusted. I think I get a problem with my wildcard-certificate on portal.customer.de

Can I use a wildcard-certificate with *.customer.de for portal.customer.de without any problems?

best regards.

Re: R80.40 Mobile Access / Capsule Connect with Password + Certificate

PhoneBoy — Wed, 16 Dec 2020 19:28:04 GMT

Should be supported to do that.
The precise debug output might be helpful.

Re: R80.40 Mobile Access / Capsule Connect with Password + Certificate

mschlumpberger — Thu, 17 Dec 2020 13:10:47 GMT

Hi,

i found in my vpnd log following message after checking wildcard certificate:
[vpnd 4688 4082022336]@fwnode02[17 Dec 13:38:22] fwCerts_FindIssuer: Could not find a matching issuer. Trying to match DN

I will import root-ca from my wildcard certificate as Trusted-CA and give an update.