-
Products
-
SonicPlatform
SonicPlatform is the cybersecurity platform purpose-built for MSPs, making managing complex security environments among multiple tenants easy and streamlined.
Discover More
-
-
Solutions
-
Federal
Protect Federal Agencies and Networks with scalable, purpose-built cybersecurity solutions
Learn MoreFederalProtect Federal Agencies and Networks with scalable, purpose-built cybersecurity solutions
Learn More - Industries
- Use Cases
-
-
Partners
-
Partner Portal
Access to deal registration, MDF, sales and marketing tools, training and more
Learn MorePartner PortalAccess to deal registration, MDF, sales and marketing tools, training and more
Learn More - SonicWall Partners
- Partner Resources
-
-
Support
-
Support Portal
Find answers to your questions by searching across our knowledge base, community, technical documentation and video tutorials
Learn MoreSupport PortalFind answers to your questions by searching across our knowledge base, community, technical documentation and video tutorials
Learn More - Support
- Resources
- Capture Labs
-
- Company
- Contact Us
Client certificate enforcement not working on MC for IOS and MAC.
07/04/2022 
0 People found this article helpful
363,336 Views
Description
Client Certificate Enforcement can be used by organizations to make sure that the end user can only connect to the VPN from the specific device which have the client certificate installed. Besides normal authentication which includes username and password, client software, on user machine, is subjected to present the client certificate to the VPN server to prove the authenticity. This will restrict users to connect from other devices which don't have the client certificate installed. Client certificate is verified against the root certificate installed on the VPN sever under CA certificate category.
Cause
When we have Client certificate added on the client side and Root certificate added on the SSL-VPN Server and we enable client certificate enforcement at the domain. It works well on each platform, except IOS and MAC when TLS 1.3 is enabled. The issue occurs with TLS 1.3 enabled on SSL-VPN Server. Reason being Client Certificate will not work on iOS/macOS due to the OS limitation using TLS1.3.
Resolution
Login to the administrative console of SMA.
1) Under System.
2) Go to Administration.
3) Under Global SSL/TLS Settings, Uncheck TLS 1.3.
NOTE: Changing TLS settings will restart the web services and other associated services, hence cause the existing connections to drop.
With these changes Certificate enforcement will work as expected on IOS and MAC using Mobile Connect.
Related Articles
- How to Set Timeout for Inactive Tunnel Connections
- Commands for silent installation of NetExtender via CMD line
- Users on Netextender 10.3.0 version failing to connect with the following error message " Cannot get a response from the server "
Categories
- Secure Mobile Access > SMA 100 Series
- Secure Mobile Access > Mobile Connect > iOS
- Secure Mobile Access > Mobile Connect > Mac
YES
NO