Adding a smart card certificate

Smart card certificates are associated with Microsoft Windows accounts, and therefore associated with a unique user. This user's certificate is signed by a certification authority so that CRLDPs can check the validity of the certificate, then publish it in an Active Directory (or an LDAP directory).

Since the firewall is able to check the user's Windows account against an authentication policy and confirm the information in the corresponding certificate, it can therefore allow smart card-connected users to access your organization's network resources.

Creating a smart card certificate

  1. Click on Add and select Add a smart card certificate.
  2. Enter a Name (CN) (mandatory).
    This is a name that will help you identify the user, and is restricted to 64 characters.
  3. Enter an ID (optional).
    Here, you can add a shortcut to your Name (CN), which will be useful for command lines (e.g., if the CN is a first name+last name pair, the identifier may match the initials of the CN).
  4. Enter the E-mail address (mandatory) of the user for whom you are creating a certificate.
  5. In the Main user name (Windows) field, enter the name of the user's Active Directory account.
  6. Click on Next.
  7. Select the Certification authority (CA) that will sign the certificate.
  8. Enter the CA password.
    The attributes of the authority will be added automatically and can be found in the smart card certificate.
  9. Click on Next.
  10. Where necessary, change the duration of the certificate's Validity (days).
    The recommended value is 365 days (suggested by default).
  11. The Key size (bits) of the certificate can also be changed.
    Even though large keys are more effective, you are advised against using them with entry-level appliances as this will mean the key will take a long time to be generated.
  12. Click on Next.
    You will be shown a summary of the information you entered.
  13. Click on Finish.

Displaying certificate details

Click once on the identity to display its detailed information on the right side of the screen:

“Details” tab

Information about the identity is shown in four windows:

  • The duration of its Validity: when its certificate was issued and when it expires,
  • Its recipient (Issued for),
  • Its Issuer: the parent authority,
  • Its Fingerprints: serial number of the certificate, encryption and signature algorithms used, etc.

Publishing a certificate in the LDAP directory

If a user that was declared in the LDAP directory indicates the same e-mail address as the one given for a user certificate, this certificate can be associated with the user.

Do note that this can only be done if the authority used to generate this certificate is the firewall's default authority.

In this case:

  1. Select the relevant certificate by clicking once,
  2. Click on the Actions menu.
  3. Select LDAP publication,
  4. In the pop-up window that appears, enter the password that will protect the PKCS#12 container of the certificate.
  5. Click on Publish certificate.