A Common Access Card (CAC) or a Personal Identity Verification (PIV) is a smart card that is used by many government employees for all user authentications. Both CAC and PIV use the X.509 standard for a Public Key Infrastructure (PKI) as an authentication mechanism to manage certificates.
The keys and the certificates are stored on the CAC card. CAC satisfies a two-factor authentication (2FA) requirement because you must place a physical card in a CAC reader and know a Personal Identification Number (PIN). The CAC card stores the public certificates and the corresponding private keys that belong to the user.
The certificate is automatically uploaded from the CAC card to the browser, and the user selects an installed certificate to log in. The user is prompted to enter a PIN. If the PIN is validated, the card unlocks a private key that is used to set up a TLS connection with the appliance. The certificate identifies the user and it is used to set up a TLS connection. If the certificate is verified and signed by a trusted Certificate Authority (CA) and has not been revoked, the user is authenticated and can log in to the Web UI. The private key never leaves the CAC card.
CAC for certificate authentication performs the following functions:
Authentication—Verifies the certificate date, obtains the revocation status of the X.509 certificate through the Online Certificate Status Protocol (OCSP) or the Certificate Revocation List (CRL), and verifies the CA certificate chain.
Authorization—Maps the X.509 certificate fields to match an entry in the Active Directory (AD) or to match locally configured rules to permit or deny access to the Web UI.
Caution
When you enable certificate authentication on the Network Detection and Response appliance, Managed Defense integration with the appliance may not operate as expected. The Managed Defense service may not have access to the appliance through the Web UI or API if the fe_services user is required to use a certificate to log in for user authentication.
Task List for Configuring the Appliance to Use CAC for Certificate Authentication
Complete the steps for configuring the appliance to use CAC for authentication in the following order:
Log in to the configuration menu.
(Optional) Configure the LDAP settings if you intend to configure the LDAP server to authorize users. For details about how to configure an LDAP server, see User Management .
Download a CA certificate bundle or add an imported certificate to an existing bundle from a specified URL. For details about uploading a CA-signed certificate to the NDR, see Uploading a Custom CA-signed Web Server certificate.
Enable policy settings to allow, require, or prohibit for certificate authentication. For details about how to enable policy settings of the Web UI, see Enabling or disabling the policy settings of the Web UI for Certificate Authentication .
Configure user attributes for certificate authentication. For details about how to configure the user attributes for certificate authentication, see Configuring the user attributes for Certificate Authentication .
(Optional) Configure OCSP so that the appliance can validate certificate revocation. For details about how to configure OCSP for certificate validation, see Adding the OCSP URL using the Configuration menu .
(Optional) Refresh the local Certificate Revocation List (CRL) file by downloading a new file from a specified remote location so that the ADD Product Series appliance can validate certificate revocation. For details about how to refresh a local CRL file for certificate validation, see Refreshing a CRL File using the Configuration menu .
Configure LDAP mappings for authorization if you use an LDAP server to authorize users. For details about how to configure LDAP mappings for authorization, see Configuring LDAP for authorization .
The user can log in to the Web UI for certificate authentication by entering the user name and password provided by the administrator, using a certificate, or both. For details about how to log in to the Web UI, see Logging in to the Web UI with Certificate Authentication .