Cato lets you upload the public keys for the corporate trusted certificates to your account in the Cato Management Application (Access > Client Access > Device Authentication). Upload the PEM file to the Device certificates section.

Note: You must add a Name for the certificate that you upload.

The following screenshot shows a sample of a signing certificate uploaded to the Device certificates section:

In the Device Authentication window, you can block or permit the device connection according to the device operating system. Use the Cato Management Application to manage device access by:

Cato lets you configure the Device Authentication in two levels: for the entire account and for the VPN user.

The following screenshot shows the Device Authentication configuration window for the account in the Cato Management Application. The Device Authentication is configured to block macOS devices and to allow Windows devices with a valid certificate:

Note: The certificates are public and should not contain sensitive data.

To configure the Device Authentication for a specific SDP user (Access > Users > {user name} > User Configuration > Device Authentication), select the Override account Device Authentication settings option and configure the settings for Blocked operating systems and the Operating systems that require a certificate. The following screenshot shows the Device Authentication configuration window for the SDP user. The Device Authentication is configured to block Android OS devices and to allow iOS devices with certificate:

The Cato Management Application lets you upload the public key of the corporate's trusted certificate for your account. This public key is the key that signs the device certificate.

The section describes how Cato validates the device certificate before it permits or blocks the connection.

Explaining the Device Connection Flow

When an SDP Client connects to the Cato Cloud, the PoP determines if a certificate is required for authentication, based on the account settings. If it does, the PoP asks the Client to authenticate with a certificate. The PoP also sends a hint to the Client with a list of issuers based on the public keys it has. The Client connects with the device certificate that was signed by the same public key and issuer, the PoP then validates the device certificate with the public key.

If the device certificate doesn’t match the public key, then the PoP blocks the attempt, and the Client can’t establish the connection. If there is a match and the validation succeed, the Client establishes the connection to the Cato Cloud.

The following screenshot shows an example of the Cato Client connecting to the Cato Cloud with a device certificate:

In the case that there are multiple device certificates that match the issuer, the Client starts with the first one until it succeeds to connect. The PoP checks that the certificate isn’t expired and that the signature of the issuer is the same authority that signed the device certificate. Cato only allows devices to connect when they are trusted by the authority.

Cato lets you upload the public keys of the corporate's trusted certificates to your account in the Cato Management Application. If a public key has expired, the PoP allows the connection only if the authority signed the device certificate before it has expired.

Cato generates alerts for an expiring public key:

For the device certificates, Cato doesn’t allow a Client to connect with an expired certificate. If a user tries to connect with an expired device certificate, the Client application notifies the PoP that the certificate has expired, and the connection is blocked.

The PoP verifies that the certificate is valid and then permits the connection for Clients.

The Event Discovery window shows these events with the certificate expiration date.

The Events screen provides two new event filter presets to help you monitor Device Authentication:

1. The Client certificate about to expire filter

You can select this preset to show all the successful connection events that are related to a device certificate that is about to expire within the next 30 days.

Note: Cato doesn’t generate a separate event for certificates that are about to expire.

The following screenshot shows a sample of the Event Discovery window when the Client certificate about to expire is applied:

2. The SDP authentication issue filter

This preset is not specifically for connecting with device certificate-based authentication, it shows all the failed connection events.

The following screenshot shows a sample of the Event screen when the SDP authentication issue filter is applied:

You can deploy your corporate self-signed certificates using any mobile devices management (MDM) or system configurator. The following sections describe the required certificate deployment configuration settings. Use the configuration for the operating system that is used by your organization devices.

macOS and iOS Cato Clients

This section describes how to distribute a self-signed certificate with an MDM or Apple Configurator.

Note: The device certificate is supported for macOs and iOS Clients version 4.4 and later.

Prerequisites:

• You must have administrator permissions for the Mac device

  Note: users with root permissions on the device are able to export the certificate and the private key, we highly recommend that IT admins will restrict it

• The certificate file must be in a PFX (p12) format

• You must know the password protecting the key (required to install the certificate)

• The certificate ‘issuer’ must match the signing certificate that is uploaded in the Cato Management Application

To distribute a certificate for macOS and iOS devices:

1. Enable the certificate payload.

2. Enable the VPN payload.

3. Install the VPN profile.

Enabling the Certificate Payload

1. Go to the Certificates payload. 

2. Enable the Certificates payload and select the certificate file (p12).

3. Enter the password and save the certificate.

 Enabling the VPN payload

1. Go to the VPN payload and enable it.

2. Configure the VPN connection using the following settings: 

   • Connection Type: Custom SSL 

   • Identifier:

     • For macOS:  com.catonetworks.mac.CatoClient 

     • For iOS:  CatoNetworks.CatoVPN 

   • Server: vpn.catonetworks.net 

   • Account: add your account name. For example: CatoNetworksAccount.

   • ProviderBundle Identifier:

     • For macOS:  com.catonetworks.mac.CatoClient.CatoClientExtension 

     • For iOS:  CatoNetworks.CatoVPN.CatoVPNNEExtenstion 

   • Provider Designated Requirement: empty

   • User Authentications: Certificate 

   • Provider Type: Packet Tunnel 

   • Credentials: Choose the certificate from the ‘Certificates’ payload 

   • Proxy Setup: None 

3. Save the profile to a file.

Installing the VPN Profile

Installing the profile creates a new network configuration (Network Preferences) and installs the certificate (Keychain Access) on your device.

To install the VPN profile file: 

• On Mac – double click on the profile file

• On iOS device – remotely send the VPN profile to your devices

After you installed the profile, add a new user to the Client.

 

To add a user to the Client:

1. Open the Cato Client.

2. Click the Add User button.

3. Add the same username and account as you entered in the Account field for the profile.

4. Click Continue.

The following screenshot shows an example of adding a new user (john) to the Client for the account (CatoNetworksAccount):

Now, the device is ready to connect to the Cato Cloud with a device certificate.

openssl genrsa -out <name>.key 2048

openssl req -new -key <name>.key -out <name>.csr

sudo openssl x509 -req -in <name>.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -out <name>.crt -days 500 -sha256

openssl pkcs12 -export -out <name>.p12 -inkey <name>.key -in <name>.crt