Client Certificate detail page

This article describes how to add a global SSL/TLS client certificate for back-end connections. Configure the client certificate, the corresponding private key, and any required CA chain so Airlock Gateway can authenticate to back-end systems that require client-certificate authentication.

Tab – Basic

Section Name

Configure the certificate material used by Airlock Gateway when it authenticates to a back-end system over TLS. This includes the client certificate, the corresponding private key, an optional passphrase for encrypted private keys, and any required CA chain.

  1. Paste the certificate in the textbox Client Certificate.
  2.  
    Example

    Example:

    -----BEGIN CERTIFICATE-----
MIIDPjCCAqegAwIBAgIBATANBgkqhkiG9w0BAQQFADCCAQcxHzAdBgNVBAoT
aW9uIEFHIC0gSGVhZHF1YXJ0ZXIxHzAdBgNVBAMTFnBoaW9uIEFHIC0gSGVh
...
I3ejmeNxHhmlEsd2ORKLyh3ofIaXpEkbf+gsQeE6UaFE83a7VKXrbsS+1zzl
Tdd0ikPqLaOQ9CmjykNigfdgAAgAirlockE65g45rf34ERRRReed545fe5==
-----END CERTIFICATE-----
    • When a Subject Alternative Name (SAN) certificate has been pasted, the domains covered by the SAN are displayed in the Alternative Names line.
  4. Optional: Place custom EC parameters below the text block of your certificate.
  5.  
    Example

    Example:

    -----BEGIN EC PARAMETERS-----
BgUrgQQAIw==
-----END EC PARAMETERS-----
  6. For intermediate CA certificates, paste the complete chain of intermediate CA certificates including the root CA into the CA chain field. All certificates must be Base64-encoded.
  7. In the Private key text box:
     
    • If you use an unencrypted Private key:
      1. Paste the key into the textbox.
      2.  
        Example

        Example:

        -----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEAutxnTm+4qp0pO/aqo5u8CMUQFuz2Ee2OdN3GV5dKyHop
efiTn9dsSO/XfXQtdBE9cz2qekspTHM/7rdwyhDcMNZoB0Mxm7MnAXA3tWg7
...
wMwB7LL/cy3BgPz338yOAI4Sg9HpJnAAUBx9AlicqtWxu+vlMVQhWXjAzTia
45zeBiPnEbittcDF7QfMCCvVnBWxAirlocktgp4tK2wNL1iF1wFMcw4Snw==
-----END RSA PRIVATE KEY----
    • If you use an encrypted Private key:
      1. Paste the key into the textbox.
      2.  
        Example

        Example:

        -----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,684AF7A6B96C1CF7

GvERCGotGQCLjG97zIF159AF0OSKj3khkql7DnYfO5Bg95afskQDK0jBKDFd
...
blTAST582u2LVZmP/lETW/l80h3NJvw7alPPiHD/JmRhZGPfXgsD1d4mn9T8
ka7nzc5HzqLuAfWs4IN9ofU/LhxXIAIRLOCK0Ii4pnE6+EI8CLi9GyivCw==
-----END RSA PRIVATE KEY-----
      3. Add the passphrase for the private key into the field Passphrase.
  9. The client certificate material is configured. The certificate is now available as a global back-end client certificate and can be used for back-end connections that require client-certificate authentication.

Section Chain verification

With this tool, the back-end certificate chain can be validated.

  1. Paste the Root CA certificate into the field.
    • The certificate content shows up in the textbox Root CA content.
  3. Click Verify certificate chain to perform a validation of CA chain down to Root CA.
  4. If the verification succeeds, the certificate chain is valid and can be traced back to the specified root CA certificate.

Tab – References

The References tab lists all entities that reference the current certificate. The table contains the columns Type and Name. Each referenced certificate is listed only once. The entries are grouped by type and sorted alphabetically. Select a certificate name to open the detail view of the corresponding entity (e.g., the detail view of a virtual host).