A Common Access Card (CAC) or a Personal Identity Verification (PIV) is a smart card that is used by many government employees for all user authentications. Both CAC and PIV use the X.509 standard for a Public Key Infrastructure (PKI) as an authentication mechanism to manage certificates.
The keys and the certificates are stored on the CAC card. CAC satisfies a two-factor authentication (2FA) because you must place a physical card in a CAC reader and know a Personal Identification Number (PIN). The CAC card stores the public certificates and the corresponding private keys that belong to the user.
The certificate is automatically uploaded from the CAC card to the browser, and the user selects an installed certificate to log in. The user is prompted to enter the PIN of the CAC card. If the PIN is validated, the card unlocks a private key that is used to set up a TLS connection with the appliance. The certificate identifies the user and it is used to set up a TLS connection. If the certificate is verified and signed by a trusted Certificate Authority (CA) and has not been revoked, the user is authenticated and can log in to the Web UI. The private key never leaves the CAC card.
The following are the two security elements to allow the user to gain access to the Web UI:
Authentication—Verifies the certificate date, obtains the revocation status of the X.509 certificate through the Online Certificate Status Protocol (OCSP) or the Certificate Revocation List (CRL), and verifies the CA certificate chain.
Authorization—Maps the X.509 certificate fields to match an entry in the Active Directory (AD) or to match locally configured rules to permit or deny access to the Web UI.
Important
X.509‑based authentication is mutually exclusive with OIDC‑based authentication. If Trellix IAM or single sign‑on (SSO) authentication are configured, do not enable CAC or PIV authentication. Trellix IAM uses the OpenID Connect (OIDC) identity layer on top of the OAuth 2.0 protocol to manage sessions between end users and their resources, and SSO authentication requires Trellix IAM.
See IAM overview and SSO authentication overview.
Task List for configuring the appliance to use CAC for certificate authentication
Complete the steps for configuring the appliance to use CAC for authentication in the following order:
Log in to the CLI.
(Optional) Configure the LDAP settings. Use this step only if you intend to configure the LDAP server to authorize users. For details about how to configure an LDAP server, see LDAP server configuration.
Download a CA certificate bundle or add an imported certificate to an existing bundle from a specified URL. For details about how to download a CA certificate bundle, see Downloading a CA certificate bundle using the CLI.
Enable policy settings of the Web UI for certificate authentication. For details about how to enable policy settings of the Web UI, see Enabling or disabling the policy settings of the Web UI for certificate authentication.
Configure user attributes for certificate authentication. For details about how to configure the user attributes for certificate authentication, see Configuring the user attributes for certificate authentication.
(Optional) Enable and configure OCSP so that the appliance can validate certificate revocation. For details about how to enable and configure OCSP for certificate validation, see Enabling or disabling OCSP using the CLI.
(Optional) Download a local Certificate Revocation List (CRL) file from a specified remote location so that the appliance can validate certificate revocation. For details about how to download a local CRL file for certificate validation, see Downloading a local CRL file using the CLI.
Configure LDAP mappings for authorization if you selected to configure an LDAP server to authorize users. For details about how to configure LDAP mappings for authorization, see Configuring LDAP for authorization.
Configure local user mappings for authorization. For details about how to configure local user mappings for authorization, see Configuring local user mappings for authorization.
On Central Management System and Network Security appliances the user can log in to the Web UI for certificate authentication by entering the user name and password provided by the administrator, using a certificate, or both. For details about how to log in to the Web UI, see Logging in to the Web UI for certificate authentication.