Enabling or disabling the policy settings of the Web UI for certificate authentication using the CLI

Important

X.509‑based authentication is mutually exclusive with OIDC‑based authentication. If Trellix IAM or single sign‑on (SSO) authentication are configured, do not enable CAC or PIV authentication. Trellix IAM uses the OpenID Connect (OIDC) identity layer on top of the OAuth 2.0 protocol to manage sessions between end users and their resources, and SSO authentication requires Trellix IAM.

See IAM overview and SSO authentication overview.

Use the CLI commands in this section to enable or disable the policy settings of the Web UI to authenticate users using a X.509 certificate.

Note

Use the no aaa authentication certificate web policy command to reset the policy not to accept a certificate for user authentication.

To enable the policy settings of the Web UI for certificate authentication:

Go to CLI configuration mode.

hostname > enable

hostname # configure terminal

Enable users to log in to Web UI for certificate authentication.
- To accept an optional X.509 certificate:
```
hostname (config) # aaa authentication certificate web policy allowed
```
Note
Users log in to the Web UI either using the user name and password provided by their administrator or using an optional X.509 certificate.
- To use only a client X.509 certificate:
```
hostname (config) # aaa authentication certificate web policy required
```

Verify the status of the policy settings of the Web UI.

hostname (config) # show aaa authentication certificate

Certificate based authentication settings:

  Web Policy                     : required

  .....

Save your changes.
```
hostname (config) # write memory
```

To disable the policy settings of the Web UI to not accept a certificate:

Go to CLI configuration mode.

hostname > enable

hostname # configure terminal

Disable the policy settings of the Web UI to not accept a client X.509 certificate.
```
hostname (config) # aaa authentication certificate web policy disabled
```

Verify the status for the policy settings of the Web UI.

hostname (config) # show aaa authentication certificate

Certificate based authentication settings:

  Web Policy                     : disabled

  .....

Save your changes.
```
hostname (config) # write memory
```