Certificates
Various features and applications require certificates to be provided. For (root) certificates on the client, note the following:
- Unless otherwise stated, the certificates must be Base64-encoded (ASCII) with file name extension
.crt. - To transfer certificates to the client, use the Scout feature Files configured for transfer. For further information, see Files configured for transfer in the Scout guide.
- On the client, the certificates are stored in the local certificate store
/setup/cacerts/or in a sub-directory. - All CA certificates in a trust chain (root and intermediate) must use an RSA key of at least 2048 bits. eLux validates TLS server certificates with OpenSSL at security level 2, which rejects any chain anchored in a 1024-bit (or weaker) CA with
certificate verify failed(verify error: num=67: CA certificate key too weak). This applies to all OpenSSL-based TLS connections, including Imprivata, firmware update over HTTPS, StoreFront/ICA over HTTPS, and 802.1X/SCEP. Note that Windows and web browsers do not enforce this minimum, so a certificate chain that works in a browser can still be rejected on eLux — the browser is not a valid test for this requirement.
The following table provides an overview:
| Feature | Component | Directory |
|---|---|---|
| Smart card user logon The certificates are specified in the Scout Console under Security > User authentication > Certificates | User authentication / AD+smart card | /setup/cacerts/login |
| Secure connection (TLS) | Firefox |
/setup/cacerts/browser (Earlier eLux versions have also used /setup/cacerts/firefox) |
| Secure connection (TLS) | Chromium | /setup/cacerts/browser |
| Secure connection (TLS) | Builtin BrowserKiosk mode | /setup/cacerts/browser |
| Secure connection (TLS) | Citrix Workspace-App |
/setup/cacerts/ and /setup/cacerts/intcerts
|
| Secure connection (TLS) | VMware Horizon client | /setup/cacerts/ |
| Secure connection (TLS) | eLuxRDP | /setup/cacerts |
| Network logon | WLAN drivers / WPA-Supplicant (802.1X)X509/RadiusNetwork Access Control / SCEP | /setup/cacerts/setup/cacerts/scep |
| VPN / OpenVPN | BaseOS | /setup/openvpn |
| VPN / Cisco AnyConnect | Cisco AnyConnect |
/setup/cacerts (from eLux RP 6 2302. Earlier versions require the certificate in /setup/cacerts/ca and /setup/cacerts/client) |
| Firmware update including certificate check | BaseOS | /setup/cacerts |
Note:
StoreFront™ can be called using a Citrix® session or a browser.
Certificates
In this article
Copied!
Failed!