Activate or Change Client Authentication (mTLS) Settings
Initial configuration of mTLS, also the possibility to change an existing configuration.
Warning
If mTLS is already configured, re-entering this menu first shows the current configuration and asks “Remove configuration and disable validation?” before it gets to any actual change. Answering “y” here — even though you opened this menu intending to change something, not disable it — immediately removes the mTLS configuration and turns off X.509 client-certificate validation. Press Enter/N to keep going and reach the actual CA/CRL/verify-depth change prompts.
X.509 Client Certificates (mTLS) Settings
X.509 Client Certificates validation is DISABLED.
Change settings? (y/<N>): y
Install a new CA chain? (y/<N>): y
You will need a file with a trusted Client Certificate CA (supports multiple)
including any intermediate certificates used to sign the client certificates.
Search the directory "/isodevice/var/transfer" for files? (Press No for USB) (<Y>/n):
Using the directory "/isodevice/var/transfer".
Available files in /isodevice/var/transfer:
mtls-ca-corp-com.pem
Which file has the Client Certificate CA (multiple CA supported)? (Q to Quit) <none>: mtls-ca-corp-com.pem
Issuers in the CA chain (/isodevice/var/transfer/storedsafe-mtls-ca.pem):
subject=C = SE, ST = Stockholm, O = Corp INC, OU = CA Team, CN = ca.corp.com
issuer=C = SE, ST = Stockholm, O = Corp INC, OU = CA Team, CN = ca.corp.com
Install the new CA for Client Certificates? (<Y>/n):
New CA for validating Client Certificates installed successfully.
It is possible to specify to what depth a client certificate should be verified:
Verify depth 0: Only self-signed certificates is allowed.
Verify depth 1: One signature is checked, so certificates directly signed
by the root cert are allowed, but nothing more.
Verify depth 2: Possible to validate up to two signatures, so chains
with one intermediate certificate are allowed. (Default)
Verify depth? <2>:
Verify depth set to 2
CRL fetching is DISABLED.
Change (or enable) CRL fetching? (<Y>/n): y
CRL URL #0? (. to end input, Q to quit) <.>: http://ca.corp.com/CorpInternalRootCAv1.crl
Try to fecth a CRL from "http://ca.corp.com/CorpInternalRootCAv1.crl"? (<Y>/n):
issuer=C = SE, O = Corp INC, CN = Corp Internal Root CA v1
lastUpdate=Apr 5 08:52:21 2023 GMT
nextUpdate=Oct 2 21:12:21 2023 GMT
crlNumber=15
CRL URL #1? (. to end input, Q to quit) <.>: http://ca.corp.com/CorpPerson4CAv1.crl
Try to fecth a CRL from "http://ca.corp.com/CorpPerson4CAv1.crl"? (<Y>/n):
issuer=C = SE, O = Corp INC, CN = Corp Person 4 CA v1
lastUpdate=May 4 18:50:01 2023 GMT
nextUpdate=May 7 20:10:01 2023 GMT
crlNumber=01FB87
CRL URL #2? (. to end input, Q to quit) <.>: https://dept.ca.corp.com/corp-crl.pem
Try to fecth a CRL from "https://dept.ca.corp.com/corp-crl.pem"? (<Y>/n):
Can not validate the CRL URL. Use it anyway? (<Y>/n):
CRL URL #3? (. to end input, Q to quit) <.>: .
Save new CRL settings? (<Y>/n):
No updates to crl from http://ca.corp.com/CorpInternalRootCAv1.crl
No updates to crl from http://ca.corp.com/CorpPerson4CAv1.crl
No updates to crl from https://dept.ca.corp.com/corp-crl.pem
Nothing to do
Restart the web server to activate the new settings? (<Y>/n):
Add firewall rules to allow for mTLS verification (port 8443/tcp)? (<Y>/n):
Web access (port 443/TCP) is currently permitted from
any
8443/TCP used for mTLS, is currently permitted from
any
Allow WEB access to the StoredSafe appliance from up to 100 networks.
(Use IPv4 or IPv6 with CIDR notation, 192.168.0.0/24 or 2001:db8:cafe::/48)
Press return to keep the suggested <DEFAULT> values. To end input at any time,
simply enter a single dot (.) and press return.
Network #0 (. to end input, Q to Quit) <any>: 192.168.16.0/24
Network #1 (. to end input, Q to Quit) <.>:
By default, the appliance redirects unencrypted requests on port 80
to port 443, however it is possible to turn off this redirection.
Allow access on port 80 (HTTP)? (y/<N>): n
Save the new configuration? (<Y>/n): y
Activate the new configuration? (<Y>/n): y
Old rules will not be deactivated until next reboot of the appliance,
unless they are manually removed thru "Remove active firewall rules"
Enable X509 as MFA? (<Y>/n): y