SonicOS 7 Device Settings

System Administration > Client Certificate Verification > Configuring Client Certificate Verification
Table of Contents

Configuring Client Certificate Verification

To configure Client Certificate Check

  1. Navigate to Device | Settings > Administration.

  2. Click Certificate Check.

  3. To enable client certificate checking and CAC support on the SonicWall Security Appliance, select Enable Client Certificate Check. If you enable this option, the other options become available. A warning confirmation message displays:

  4. Click OK.

  5. To activate the client certification cache, select Enable Client Certificate Cache.

    The cache expires 24 hours after being enabled.

  6. To specify from which certificate field the user name is obtained, choose an option from :
    • Subject: Common Name (default)
    • Sub Alt: Email
    • Sub Alt: Microsoft Universal Principal Name

  7. To select a Certification Authority (CA) certificate issuer, choose one from the Client Certificate Issuer drop-down menu. The default is thawte Primary Root CA - G3.

    If the appropriate CA is not listed, you need to import that CA into the SonicWall Security Appliance. See Managing Certificates section.

  8. To select how to obtain the CAC user group membership and, thus, determine the correct user privilege, choose from the CAC user group memberships retrieve method drop-down menu:
    • Local Configured (default) – If selected, you should create local user groups with proper memberships.
    • From LDAP – If selected, you need to configure the LDAP server. (see Configuring the SonicWall for LDAP section in SonicOS 7.0 Users document available at https://www.sonicwall.com/support/technical-documentation/.

  9. To enable the Online Certificate Status Protocol (OCSP) check to verify the client certificate is still valid and has not been revoked, select Enable OCSP Checking. When this option is enabled, the field displays and the Enable periodic OCSP Check option displays.

    Enter the URL of the OSCP server that verifies the status of the client certificate in the OCSP Responder URL field.

    The OCSP Responder URL is usually embedded inside the client certificate and does not need to be entered. If the client certificate does not have an OCSP link, you can enter the URL link. The link should point to the Common Gateway Interface (CGI) on the server side, which processes the OCSP checking. For example: http://10.103.63.251/ocsp.

  10. To enable a periodic OCSP check for the client certificate for verifying that the certificate is still valid and has not been revoked:
    1. Select Enable periodic OCSP Check. The OCSP check interval field becomes available.
    2. Enter the interval between OCSP checks, in hours, in the OCSP check interval 1~72 (in hours) field. The minimum interval is 1 hour, the maximum is 72 hours, and the default is 24 hours.
  11. Click Accept.