Setting Up Client Certificate Verification

You can configure OneSpan Authentication Server to require a client certificate whenever a client attempts to establish a connection. Currently, client certificate verification is supported for SOAP or SEAL clients. This is particularly useful to secure connections between the Administration Web Interface and OneSpan Authentication Server if the former is installed on a remote host.

In this context, client certificate verification for the Administration Web Interface secures the connection between the Administration Web Interface remote host and OneSpan Authentication Server. In contrast, the Apache Tomcat TLS/SSL certificates created by OneSpan Authentication Server during installation are used to secure the browser connections to the Administration Web Interface (see Figure: Clients communicating with OneSpan Authentication Server via TLS/SSL-secured connections).

Figure:  Clients communicating with OneSpan Authentication Server via TLS/SSL-secured connections

To set up client certificate verification for OneSpan Authentication Server clients, you need the following:

• The client certificate.
• The client certificate's private key file.
• The certification authority (CA) certificate file (if self-signed, this will be the same file as the client certificate).