Modify a Rule Set to Configure Certificate Authorities

The Authentication Server (for X509 Authentication) rule set needs to be modified to ensure appropriate Root CAs (certificate authorities) are configured. The modification is done in a nested rule set.

A client certificate is trusted if signed by a certificate authority from the list that is maintained on the appliance. You need to import all certificate authorities into the list that you want to be signing instances for trusted client certificates.

1. Select Policy | Rule Sets and expand the Authentication Server (for X509 Authentication) rule set.
2. Expand the nested SSL Authentication Server Request rule set.
3. In the Ask user for client certificate rule, click the X509 Auth module settings.
   The Edit Settings window opens.
4. In the Client Certificate Specific Parameters section, review the list of certificate authorities.
5. To add a certificate authority to the list:
   1. Click the Add icon above the list.
      The Add Certificate Authority window opens.
   2. In the Host field, enter the host name or IP address that the certificate should be submitted for.
   3. Click Import.
      A window providing access to your local file system opens.
   4. Browse to the certificate authority file you want to import.
   5. Click OK.
      The window closes and the import is performed. The certificate appears in the Add Certificate Authority window.
6. Make sure the Trusted checkbox is selected.
7. [Optional] In the Comment field, type a plain-text comment on the certificate authority.
8. Click OK.
   The window closes and the certificate authority appears in the list.
9. Click OK to close the Edit Settings window.
10. Click Save Changes.