How to setup machine certificate authentication?

[Herman]

Hello community!
I want to undestand how correctly enable machine certificate for separete VPN access for AD domain machines and AD users.
If I right about this, that for enable this feature I should:

1. Get root cert and intermediate cert in my CA, added this certs to checkpoint environment (according sk149253) for ability generate CSR request for each future machine cert (and this I have a question, after I get cert, generated from CSR, where it is should putted in user machine? For example in windows machine, in certmgr -> "trusted root cert authorities" or other place?);
2. In VPN Gateway activate feature "VPN Clients" -> "Authentication" -> select checkbox "Send Machine Certificate";
3. Finally create rule with AccessRole (of couse, before it, activate Identity awareness for required AD server) in RuleBase as follow:
   

Please clarify or correct my suggestions about machine certificate option for VPN.

[G_W_Albrecht]

sk121173: Machine Certificate Installation on Security Gateway for Authentication to VPN Clients

[yunier88]

Hello,

In my case I would like to be able to find some more detailed documentation or a course where I explain how to configure MAchine Certificat. If you found any documentation that explains better how to activate it, I would appreciate it if you shared it

Thanks

[G_W_Albrecht]

https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_RemoteAccessVPN_AdminGuide/T...

[yunier88]

Thanks for sharing that link, but I can't find all the necessary information is there. For example, nowhere does it explain where and how the certificate is configured on the client side. It also doesn't explain how the client couldn't take the certificate and install it on another computer. This documentation does not help me much, if you have any other information to share I would appreciate it

[G_W_Albrecht]

I am not quite sure what you are talking about - the 3rd paragraph reads:

Machine certificate authentication works with the Endpoint Client only. For more details on how to configure this feature on the client side, see Machine Authentication in the E80.72 and Higher Remote Access Clients Administration Guide.

[yunier88]

Hello,

First of all thank you for your quick response. In the documentation that invites me to follow, there is the configuration of the Endpoint Client and the parameters to set to use a certificate. But I can't find anywhere where it explains:
1- Where to install the certificate on the user's computer.
2-Which certificate to install on the user side
I only find the process of creating and installing the certificate on the gateway, but no documentation explains how to work with this certificate on the client's computer. I hope I have been a little clearer in my doubts
Thank you

[JC_S]

Generally speaking, machine authentication certificates are done through Microsoft AD or similar.  Group policy can be configured related to auto-enrollment from the Microsoft CA, and enforced through their mechanisms.  The machine certificates are stored in the certlm console page (On most Windows computers, just begin typing certificate in and you should see Manage Computer Certificates) which is part of the CAPI store.

If you are manually installing a 3rd party certificate for machine cert, then you will need to make sure you have a way to let your DC know about the machine certificates, as access is generally defined by OU for machine-auth.

[LazarusG]

Hi JC_S 

The manual points to sk149253 as the first step which has instructions to add 3rd party ipsec certificate. I have had many customers querying this. I have been advising them that only steps 1-14 are relevant and to use only the internal CA tied to their Domain. 

Are you saying that I was incorrect and that it is possible to use a third party PKI for this afterall?

If so is there any instruction on how to make AD aware of the 3rd party so that client presented certs will allow authentication against the domain?

Thanks in advance.

[yunier88]

Hello,

I would like to know if you found the answer to your questions. I also need to know where the certificate is installed on the client side.

Thank you

[evigl]

Hi all, I'm still straggling myself....in case anyone can provide more detailed info, any help will be much appreciated 🙂 

Cheers!

Helen

[Mikael]

Hello,

The cert should be placed in the cert-store for local-machine for use with machine-only tunnels.

[Howard_Gyton]

For us we have the client certificate in Personal, the CA is in Trusted Root, and the Sub-CA is in "Intermediate Certification".  These last two correspond to the Root, and Sub-CA server objects created in SmartConsole respectively.  Certs are deployed via Group Policy.

[zr4]

nice