Authenticating HTTPS Certificate

The MFT Server supports HTTPS certificate authentication.

Prerequisites

To enable HTTPS certificate authentication, you must create a private key and associate the private key with the browser. Each browser has a different way of handling private keys. This document does not describe how to associate a private key with a browser.

Procedure

  1. Update <MFT-Install>/server/conf/server.xml.
    1. Locate the HTTPS connector.
    2. Change parameter clientAuth = false to clientAuth = want. This allows certificate or password authentication to the server.
  2. Restart the MFT Internet Server or MFT Command Center Server.
  3. Log on to the Internet Server or Command Center Admin console.
    1. Navigate to Administration > Protocol Keys > Add Public Key.
    2. Set the Public Key Type to HTTPS Public Key.
    3. Set Apply Key to to User.
    4. Select the user to associate with the certificate.
    5. Set Status to Enabled.
    6. Set Description to a unique descriptive value.
    7. Copy/paste the certificate into the Enter the X.509 Certificate in the box below input field.
    8. Click Continue.
      The Add Public Key Confirmation page is displayed.



  1. Review the information and click Continue.
    The key is added to the server and associated with the defined user.
  2. Navigate to Users > Manage Users and select the user that requires certificate authentication.



  1. Set HTTPS Client Authentication Method to Certificate Only.
  2. Click Update to save the changes.
  3. Configure the browser to use certificate authentication.
    When the browser connects to MFT, it displays a list of certificates that can be used.
  4. Select the certificate to use and click OK or Continue.
    Note: You should be logged onto the MFT Internet Server or Command Center.

Result

When a browser connects to Internet Server or Command Center, the server requests a certificate from the browser. It verifies the certificate against the HTTPS certificates added in prior steps. If a match is found, the logon request is successful. Otherwise, the logon request fails.