Certificate map objects

A certificate map object is a configuration element that

  • contains a named set of certificate matching rules,

  • associates a received certificate with a remote access VPN connection profile, and

  • matches rules in priority order, ending when the first rule results in a match.

Certificate map object reference information

Remote access VPN policies use certificate map objects to map certificates to connection profiles. If a received certificate matches the rules in a certificate map, the system associates the connection with the specified profile.

Both certificate map objects and connection profiles are components of a remote access VPN policy.

  • The rules are matched in the order shown in the UI.

  • Matching ends when the first rule within the certificate map object results in a match.

Navigation path for certificate map objects:

  • Objects > VPN > Certificate Map

Fields in certificate map objects:

  • Name: Identifies this object so it can be referred to from other configurations, such as remote access VPN.

  • Mapping criteria: Specifies the contents of the certificate to evaluate. If the certificate satisfies these rules, the user is mapped to the connection profile containing this object.

    • Field: Select the field for the matching rule according to the subject or issuer of the client certificate.

      If you set the Field to Alternative Subject or Extended Key Usage, the component remains fixed as Whole Field.

    • Component: Select the component of the client certificate to use for the matching rule.

      Note

      SER (Serial Number) component: Ensure you specify the serial number for the subject field. The certificate map only matches with a serial number attribute in the subject name.

    • Operator: Select the operator for the matching rule:

      • Equals: The certificate component must match the entered value. If they do not match exactly, the connection is denied.

      • Contains: The certificate component must contain the entered value. If the component does not contain the value, the connection is denied.

      • Does not equal: The certificate component cannot equal the entered value. For example, for a selected certificate component of country and an entered value of US, if the client country value equals US, then the connection is denied.

      • Does not contain: The certificate component cannot contain the entered value. For example, for a selected certificate component of country and an entered value of US, if the client country value contains US, the connection is denied.

  • Value: The value of the matching rule. The value entered is associated with the selected component and operator.