Adding a user identity

In the configuration wizard, enter the information relating to the user for whom you are creating an identity.

Creating a user identity

  1. Click on Add.
  2. Select User identity.
  3. Enter a CN (mandatory).
    This is a name that will help you identify the user, and is restricted to 64 characters.
  4. Enter an ID (optional).
    Here, you can add a shortcut to your CN, which will be useful for command lines (e.g., if the CN is a first name+last name pair, the identifier may correspond to the initials of the CN).
  5. Enter the E-mail address (mandatory) of the user for whom you are creating an identity.
  6. Click on Next.
  7. Select the Parent authority that will sign the certificate for the identity.
  8. Enter the Top CA passphrase.
    The attributes of the authority will be added automatically and can be found in the user certificate.
  9. Click on Next.
  10. When the firewall has a TPM that has been initialized, select the checkbox Protect this identity with the TPM to protect the identity's private key with the TPM.
  11. Where necessary, change the duration of the certificate's Validity (days).
    The recommended value is 365 days (suggested by default).
  12. The Key size (bits) of the certificate can also be changed.
    Even though large keys are more effective, you are advised against using them with entry-level appliances as this will mean the key will take a long time to be generated.

  13. If a user that was declared in the LDAP directory indicates the same e-mail address as the one given in step 4, this identity can be automatically associated with the user.
    However, this can only be done if the authority used to generate the certificate is the firewall's default authority. In this case:

    • Select Publish this identity in the LDAP directory,
    • Enter the password that will protect the PKCS#12 container of the identity.
  14. Click on Next.
    You will be shown a summary of the information you entered.
  15. Click on Finish.

The identity will automatically be added to the tree of authorities, identities and certificates defined on the firewall, under its parent authority.

Displaying identity details

Click once on the identity to display its detailed information on the right side of the screen:

“Details” tab

Data about the identity is shown in six windows:

  • Its Usage: the modules in which the identity certificate is used, and any TPM-protected private key of the identity, if the firewall is equipped with a TPM.
  • The duration of its Validity: when its certificate was issued and when it expires,
  • Its recipient (Issued for): details about the user (name, email address, etc.) and the subject of the certificate.
  • Its Issuer: the parent authority,
  • Its Fingerprints: serial number of the certificate, encryption and signature algorithms used, etc.

Revocation (CRL) tab

  • The URLs of the parent authority's CRL distribution points,
  • The URLs of OCSP servers if OCSP is used in certificate renewal.

Publishing an identity in the LDAP directory

If a user that was declared in the LDAP directory indicates the same e-mail address as the one given for a user certificate, this identity can be associated with the user, if you did not already do so while you were creating the identity.

Do note that this can only be done if the authority used to generate this identity is the firewall's default authority.

In this case:

  1. Select the relevant identity by clicking once,
  2. Click on the Actions menu.
  3. Select LDAP publication,
  4. In the pop-up window that appears, enter the password that will protect the PKCS#12 container of the identity.
  5. Click on Publish certificate.