Technical Notes

Using SSH-Certtool to Generate Certificate Requests and Configuring Certificate Authentication for Reflection for Secure IT Windows Client
Technical Note 1874
Last Reviewed 01-Feb-2008
Applies To
Reflection for Secure IT Windows Client version 6.0 or higher
Reflection for Secure IT Windows Server version 6.0.x through 6.1.x
Summary

This technical note describes the steps to follow when connecting from a Reflection for Secure IT Windows Client to a Reflection for Secure IT Windows Server using certificate authentication. You will use the certificate generation utility on the Reflection SSH Windows server to create a certificate request and convert the resulting signed certificate and private key into the proper format.

Note: This note is intended for server administrators who are generating certificates for users. The certificate generation utility, ssh-certtool, is available only in Reflection for Secure IT Windows Server version 6.0 build 24 through 6.1.x. The certtool is not available in the client product.

Certificate Authentication Overview

Certificate authentication is one way a server can authenticate a user. It requires three items:

• a client PKCS12.pfx certificate package, which is imported into the client’s Microsoft Certificate Store
• the Trusted Root Certificate Authority (CA) certificate
• the user certificate mapping file

The Trusted Root CA certificate and the user certificate mapping file are uploaded to the Reflection for Secure IT Windows Server.

Overview of Configuration Steps

Configuring Reflection for Secure IT Windows Client for certificate authentication is a multi-step process:

1. Generate a certificate request using the ssh-certtool utility on the Reflection SSH Windows server and send it to a Certificate Authority (CA). The CA sends you your signed certificate and their Trusted Root CA Certificate.
2. Create a PKCS12 package with your private key and the signed certificate sent to you by the CA.
3. Configuring the client to store and use certificates.
4. Configure Certificate User Authorization on the Reflection SSH Windows Server.
5. Add the Trusted Root CA Certificate and the Certificate User Authorization to the Reflection server.

The rest of this technical note outlines the procedures to configure certificate authentication on the client. Note: Some preliminary configuration must be done on the Reflection SSH server.

Using the SSH-Certtool Certificate Utility

Use the ssh-certtool utility (on the Reflection SSH Windows server) to generate a certificate request, and later a PKCS12 package for the client. The steps vary depending on certificate type, extensions, and other factors, including how you choose to sign your certificates.

Note: The version of the ssh-certtool utility required to generate a certificate is available in Reflection for Secure IT Window Server version 6.0 build 24 through 6.1.x.

1. On the Reflection for Secure IT Windows Server, open the ssh-certtool, typically found in the C:\Program Files\F-Secure\ssh server folder on the Reflection for Secure IT server.
2. Enter this command to generate a certificate request that you can send to your Certificate Authority for signing:

3. The ssh-certtool utility generates two files:

4. Send the resulting pkcs10 file (in our example, user1.pkcs10) to your Certificate Authority for signing.

5. You will receive your CA-signed client certificate in a "Base-64 encoded" or ".pem" format depending on the CA. Either format is acceptable. Note: Do not use DER encoded binary format.

6. Rename your CA-signed client certificate using a .crt extension, for example, user1.ssh2.crt.

Create a PKCS12 Package

After you receive your CA-signed client certificate from the Certificate Authority, you will need to create a PKCS12 package to import into the Microsoft Certificate Store or Reflection’s Certificate Store in version 6.1.

1. On the Reflection SSH Windows server, generate the PKCS12 package using the following command:

2. When prompted, enter a passphrase that you will remember. Using an empty passphrase is not recommended because it is less secure.

3. Rename the file to match the files above, such as user1.p12.

Configuring the Client to Store and Use Certificates

You can configure the client to store and use certificates from the Microsoft Certificate Store, or beginning in version 6.1, you can configure the client to store and use certificates from Reflection's certificate store.

Using the Microsoft Certificate Store

Follow these steps to configure the client to store and use certificates from the Microsoft Certificate Store.

1. Double-click the file you created (in our example, user1.p12) to install it to the Microsoft Certificate Store. Use the passphrase that you entered in step 2 of the Create a PKCS12 Package section.

2. In the Reflection for Secure IT client, open the Connection > Connection Setup dialog box.
3. Enter a host name and user name to enable the Security button. Click the button to open the Reflection Secure Shell Settings dialog box.
4. On the General tab, under User Authentication, clear Keyboard Interactive, Password, and GSSAPI/Kerberos, leaving Public Key as the only selected option.
5. Click the User Keys tab and select the client certificate that you created in the "Create a PKCS12 Package" section with your private key and signed public key (in our example, user1.p12).
6. Click OK and save your settings.

Using Reflection's Certificate Store

Beginning in Reflection version 6.1, you can configure the Reflection SSH Windows client to store certificates in Reflection's certificate store.

1. In the Reflection for Secure IT client, open the Connection > Connection Setup dialog box.
2. Enter a host name and user name to enable the Security button. Click the button to open the Reflection Secure Shell Settings dialog box.
3. On the General tab, under User Authentication, clear Keyboard Interactive, Password, and GSSAPI/Kerberos, leaving Public Key as the only selected option.
4. On the PKI tab, click the Reflection Certificate Manager button.
5. In the Reflection Certificate Manager button, on the Personal tab, click the Import button.
6. Select the client certificate that you created in the "Create a PKCS12 Package" section with your private key and signed public key (in our example, user1.p12). Follow the prompts to import your certificate.

7. Click Close, and then click OK.
8. Click the Security button to open the Reflection Secure Shell Settings dialog box.
9. On the User Keys tab, select the certificate imported in step 6. Note that the location of the key is the Reflection Certificate Store.
10. Click OK.

Configuring Certificate User Authorization on the Reflection for Secure IT Windows Server

The steps you follow to configure certificate user authorization depends on the version of Reflection for Secure IT Windows Server that you use:

Version 6.1.x

When user certificates are used to authenticate to remote server(s), the remote server administrator must configure Certificate User Authorization on the server and add the Trusted Root CA certificate. (See To Obtain the Trusted Root CA Certificate for more information.)

1. Open the Reflection for Secure IT Windows Server. In Server Configuration, click User Authentication to expand the tree, and then click Public Key > Certificates.

1. Open the Reflection for Secure IT Windows Server. In Server Configuration, click User Authentication to expand the tree, and then click Public Key > Certificates. Click Add to add a new Trusted Root CA or Edit an existing one.
2. In the Trusted CA Certificate field, browse (using the

3. Select the file and click OK.
2. In the Certificate User Authorization field, browse to the .txt file that contains your user mapping file or select the Edit button and create or modify the file. This file is used to verify the user and the certificate being presented for this user. It must match the client certificate data in one of the fields, such as the Subject, Email, SerialAndIssuer or EmailRegex fields, in the proper format as shown in the example below:

3. Click Apply.

Next, proceed to Connect Using Certificate Authentication.

To Obtain the Trusted Root CA Certificate

When you submitted the certificate request to your Certificate Authority for signing, they sent your signed certificate and the Trusted Root CA Certificate. If you did not receive the Trusted Root CA Certificate when the CA sent you your signed certificate, you can obtain it in one of two ways:

• Download it from your signing Certificate Authority’s website.
• Open the received signed certificate by double-clicking it and then selecting the Certificate Path tab. Click the uppermost certificate and then select View Certificate > Details > Copy to File.

Return to Version 6.1.x instructions.

Version 6.0.x

When user certificates are used to authenticate to remote server(s), the remote server administrator must configure Certificate User Authorization on the server and add the Trusted Root CA certificate (if it has not previously been added). Follow these steps to configure Certificate User Authorization.

1. Open the Reflection for Secure IT Windows Server. In Server Configuration, click User Authentication to expand the tree, and then click Public Key > Certificates.
2. In the Certificate User Authorization field, browse to the .txt file that contains your user mapping file or select the Edit button and create or modify the file. This file is used to verify the user and the certificate being presented for this user. It must match the client certificate data in one of the fields, such as the Subject, Email, SerialAndIssuer or EmailRegex fields, in the proper format as shown in the example below:

3. Click Apply.

Add the Trusted Root CA Certificate to the Reflection for Secure IT Windows Server 6.0.x

Note: If you have previously imported the Trusted Root CA certificate, you do not need to import it again; you may proceed to Connect Using Certificate Authentication.

When you submitted the certificate request to your Certificate Authority for signing, they sent your signed certificate and the Trusted Root CA Certificate. For background information on this topic, read About Trusted Root CA Certificates.

Obtaining the Trusted Root CA Certificate

If you did not receive the Trusted Root CA Certificate when the CA sent you your signed certificate, you can obtain it in one of two ways:

• Download it from your signing Certificate Authority’s website.
• Open the received signed certificate by double-clicking it and then selecting the Certificate Path tab. Click the uppermost certificate and then select View Certificate > Details > Copy to File.

Adding the Trusted Root CA Certificate

Follow these steps to add the Trusted Root CA certificate to the Reflection server.

1. Open the Reflection for Secure IT Windows Server. In Server Configuration, click User Authentication to expand the tree, and then click Public Key > Certificates.
2. In the Trusted CA Certificate field, browse (using the

3. Click Apply.

Connect Using Certificate Authentication

Now your Reflection for Secure IT Windows Client is configured to support client certificate authentication. Click Connect on the Reflection for Secure IT client, and you will see a padlock on the Status Line indicating your connection is secure.

For information about configuring Reflection for Secure IT Windows Server for certificate authentication, see Technical Note 1873.

About Trusted Root CA Certificates

A certificate issued by a Certification Authority (CA) to itself is called a Trusted Root certificate; it is the anchor point for a chain of trust. When one entity uses a certificate to authenticate itself, the other entity must verify the trust relationship between the first entity's certificate and the Trusted Root CA that is at the beginning of the chain of trust.

For example, if a user is presenting a certificate to authenticate themselves to the server, the server needs to verify two conditions:

1. User has the private key for the public key contained in the certificate and can correctly sign an authentication message.
2. The signatures of any intermediate CA certificates are valid all the way to the Trusted Root CA.

This second validation requires that the Trusted Root certificate for the user's certificate resides in the Trusted Root store on the server and that any intermediate CA certificates can be obtained.

Related Technical Notes

1873	Using SSH-Certtool to Generate Certificate Requests and Configuring Certificate Authentication for Reflection for Secure IT Windows Server
1941	Using SSH-Certtool to Generate Certificate Requests and Configuring Certificate Authentication for Reflection for Secure IT UNIX Server
1942	Using SSH-Certtool to Generate Certificate Requests and Configuring Certificate Authentication for Reflection for Secure IT UNIX Client