About masterstur_

masterstur_ · ‎02-05-2014

Hello, I am trying to work out mobile client certs for authentication. I already have a signed device cert for both internal/external ports of the juniper device, and I already have a self-signed CA. Client certs work fine on desktops using that self-signed CA. However, attempting to log in from the junos pulse app results in "missing certificate" regardless of how I attempt to install it. (vie keystore, via file, as two separate .der formatted files, etc.) This seems to be specific to the app, going to chrome on my tablet and just selecting a cert from the keystore works as well. Is it because I am enforcing authentication through AD credientials AND certificate and the app can only do 1 or the other? I'm kinda out of ideas here.... Thanks!

masterstur_ · ‎01-27-2014

Hrm bear with me I am unsure how to best phrase this... We recently purchased the MAG2600 and I am a bit lost and the most effective way to deal with mobile clients and certificates. This is a fairly small shop so I'd like to keep it relatively simple. Our original idea was to have one login url/one sign in page that requires a certificate tied to the mobile device. That seems fine, but then we would require device certificates for anyone connecting from their home PC or using the pulse client, correct? We ideally would like to avoid that requirement and allow more basic authentication from home desktops. So is there a way to accomplish that? The only way I can see if not is creating multiple authentication realms, one for desktops and one for mobile devices and having two sign in pages to avoid forcing a user to pick the realm. (Ideally to make this as brainless and seamless to them as possible) and locking each one down so only the intended use scenario can access each. So I guess the big question is: With a single authentication realm can you both enforce certificates for specific devices and NOT enforce them for others? And if not, what is the "best" way to go about this using two different realms. (Or perhaps we're overthinking this?) Thanks!

masterstur_ · ‎01-27-2014

Sorry about that missing info: I've tested this on both android and iOS and get the same result. (I am using a Galaxy Nexus 10 and Moto X both running 4.4, my coworker is using an iPhone 5 running iOS 7). Following the steps in that picture still ends up with a "missing certificate" error with the very same cert that allows access through a web browser. It's almost as if the app is ignoring what cert I ask it to use and looking elsewhere entirely. For what it's worth I am generating these certs self-signed using our own CA and openssl. Let me know if you need any other information, thanks! EDIT: Scratch that! I put the "mobile realm" we're using for this off onto it's own URL as to not require an active directory password (and so only require the cert) and everything works. So then my new question would be: Within the pulse app, can we require both a cert and a user's AD credentials? The way we had it set up works for desktops/mobile browsers like I already said, so then perhaps there's a different configuration that will work for the app? Or is that just not possible yet? Double Edit: Nevermind, I completely forgot about specifying an additional authorization server. Somehow I blanked out on that, my bad. Thanks!

Pulse App: Missing Cert?

BYOD Certificate best practice?

Re: Pulse App: Missing Cert?