Installing a Private Certificate on a Client

Application Scenarios

In two-way authentication, a client must have a certificate installed to establish a trusted connection with the server. When two-way authentication is enabled for intranet microservices, IoT devices, or enterprise service systems, the server verifies the client certificate presented by the client. If no client certificate is installed on the client, the server returns a 400 Bad Request error when the client attempts to access the service.

After the client certificate is installed on the client OS, the client can present the certificate during the TLS handshake. The server then verifies the client identity, enabling two-way authentication. Typical service scenarios: IoT device identity authentication, certificate-based two-way authentication for browsers on enterprise intranets, and smart card login for Windows domains.

Prerequisites

You have downloaded an issued private certificate. For details about how to download a certificate, see Downloading a Private Certificate.

Constraints

If the server needs to verify the client certificate, you need to add the root CA of the client certificate to the trusted root CA store on the server. For details, see Trusting a Private Root CA.

Procedure for Installing a Private Certificate on a Client

This procedure uses Windows as an example.

1. Log in to the CCM console.
2. In the navigation pane on the left, choose Private Certificate Management > Private Certificates.
3. Locate the row containing the desired certificate. In the Operation column, click Download.
4. Select the IIS tab and click Download Certificate.
5. Decompress the downloaded certificate file package client_iis.zip to obtain certificate file server.pfx and private key password file keystorePass.txt.
6. Double-click certificate file server.pfx, select a certificate storage location based on its usage, and click Next.
7. Confirm the name of the certificate file you want to import and click Next.
8. Enter the password obtained from private key password file keystorePass.txt and click Next.
9. Select Place all certificates in the following store, click Browse, select Personal, and click OK, as shown in Figure 1.
   Figure 1 Storing a private certificate
   

10. Click Next and Finish. The certificate is installed when a dialog box is displayed indicating that the certificate is imported successfully.

References

• Downloading a Private Certificate: describes preparations for downloading a client certificate.
• Trusting a Root CA: describes how to import a root CA into the client to establish trust.
• Installing a Private Certificate on a Server: describes how to deploy a private certificate on a server.