Forum Discussion
AlexDC_262478
Nimbostratus
NimbostratusClient Certificate Authentication - Machine or Client cert APM method
Hello,
I understand the Machine cert checker is a client-side check and the client cert checks are performed as part of SSL negotiation. What I'm not sure about is which method to use to do basi...
Hello,
Machine cert auth is heavy for the endpoint. The browser need admin rights to access and present the certificate located within the local machine store. That's why you need to install an helper from F5 on client devices. I think that it works with Microsoft devices only. My rules are if you need a 802.1x like solution so machine cert validation is the right solution. Otherwise, I would recommend to go with client cert auth that offer more flexibility and can be used outside APM. In both case Crl and ocsp checking works the same.
Yann_Desmarest_
Nacreous
NacreousHello,
Machine cert auth is heavy for the endpoint. The browser need admin rights to access and present the certificate located within the local machine store. That's why you need to install an helper from F5 on client devices. I think that it works with Microsoft devices only. My rules are if you need a 802.1x like solution so machine cert validation is the right solution. Otherwise, I would recommend to go with client cert auth that offer more flexibility and can be used outside APM. In both case Crl and ocsp checking works the same.
AlexDC_262478Nimbostratus
Nimbostratusthanks for the response, so the machine cert and client cert from an endpoint perspective are two different certs or in 2 different stores? i.e. is the decision to use which auth method driven also by which cert is installed on the endpoint i.e. corporate laptops, would a installed device certificate be available for machine cert auth and client cert auth? Also, I have read that machine cert didn't support CRL is that the case? thanks