Client Trusted Certificates

Provision trusted certificates to clients

The Adaptiva client can leverage trusted certificates for secure client communication with network security applications or appliances. In the Admin Portal, you can issue trusted certificates to a PKI store on managed Adaptiva client groups or Business Units.

This enables scenarios such as SSL inspection, where the Adaptiva Client establishes trust with a security application (such as Zscaler) using the certificate provisioned to the pki store on the device. This feature supports Windows, MacOS, and Linux devices.

Add Client Trusted Certificates

1. Navigate to Settings > Client Trusted Certificates > Certificates. The uploaded certificate must be a PEM-encoded X.509 certificate.

   

   Certificate Settings Menu
2. Click + New.

3. Enter a Name.

4. Open your .pem and copy the public key into the Certificate text box.

5. Click Save. The identity will be parsed from the certificate and displayed.

   

   Create New Certificate

Add Certificates with Policies

1. On the top level navigation of the certificates page, click Policies.

2. Click + New.

3. Under General Settings, enter a Name and Description of the policy.

4. Under Certificate Settings, next to Certificates, click Browse.

5. On the Select Client Trusted Certificate page, click to select the certificate(s). You can multi-select if there are multiple certificates to deploy using a single policy.

6. Click OK.

7. Next to Target Groups, click Browse.

8. On the Select Group page, click to select the Group(s) or Business Unit(s) you wish to apply the policy to. You can define policies to target different groups of devices with different certificates.

9. Click OK.

10. Click Save.

    

    Certificate Policy Provisioning

Client Certificate Store

The Adaptiva Client by default looks in multiple certificate stores: the data/pki directory, the system trusted certificate store, and the JVM cacerts file. When changes are made to the certificate store, the Client will restart within 60 seconds to ensure that only up-to-date certificates are being used.

You can view the certificate store on a client machine by navigating to %AdaptivaClient%\data\pki. All certificates assigned to the client by a certificate policy will be stored as .crt files in this directory.