Summary

Mutual TLS (mTLS) authentication with certificates configured on beacons and inventory device computers running the FlexNet inventory agent can be used help ensure a level of trust between beacons and inventory devices. This article describes how this may be configured using Client Certificate Mapping Authentication settings in IIS on a beacon.

There are two ways to configure Client Certificate Mapping Authentication:

1. Using one-to-one client certificate mappings where inventory devices have a copy of the private key of the beacon's certificate.
2. Using many-to-one client certificate mappings where the beacon only accepts connections from inventory devices that have certificates issued from a specific Certificate Authority.

This article is focused on the many-to-one type configuration, but the ideas described can be easily adapted to apply the one-to-one type configuration

Configuration overview

The purpose of this solution is to ensure that only authorized inventory devices can access a beacon. This setup is based on using Client Certificate Mapping Authentication that is configured in IIS.

The following diagram shows the high-level design of this configuration:

Key points illustrated in this diagram are:

• A certificate is configured in the IIS web site on the beacon.
• A client authentication certificate issued by the local certificate authority (CA) service is installed on each inventory device computer that the FlexNet inventory agent runs on.
• It is assumed that the beacon will be hosted in a dedicated AWS VPC network. The beacon should
  have network access to any CA Certificate Revocation list (CRL) URLs that are specified in client certificates to protect against inventory devices with revoked or expired certificates from being able to connect to the beacon.
• It is also assumed that an application firewall is implemented for additional network security. This is not a requirement, and not described further in this article.

Setup and configuration

The setup of this solution requires minimal changes in the IIS web site configuration on the beacon.

Prerequisites

This solution requires:

• The IIS Client Certificate Mapping Authentication role is installed on the beacon.
• Appropriate client certificates are deployed to inventory device computers.
• A Client and Server Authentication certificate is available for configuring on the beacon.
• The certificate issuer is configured in the Trusted Root Certification Authorities store on both the
  beacon and all the Windows inventory device computers that are communicating with the beacon.

IIS configuration

The following steps illustrate how IIS may be set up on the beacon for this configuration.

1. Install the Client and Server Authentication certificate in the Default Web Site Bindings:
   
   
   
2. Configure the SSL Settings for the Default Web Site: check the Require SSL option, and the option to Require client certificates:
   
   
   
3. Configure the IIS client certificate mapping properties:
   
   
   
4. Set the manyToOneCertificateMappingsEnabled setting to True, and open the properties of the manyToOneMappings setting:
   
   
   
5. Add Issuer as matching criteria to match client certificates that your beacon should accept. Additional Issuer and Subject criteria can be added if needed:
   

Related information

Additional information related to this topic can be found at the following locations:

• FlexNet Manager Suite documentation:
  • Gathering FlexNet Inventory > Common: Supporting Mutual TLS
  • FlexNet Manager Suite Online Help > Configuring Mutual TLS
  • Features by Release > Support for mutual TLS on UNIX-like devices
• FlexNet Manager Suite knowledge base:
  • Configure Client Certificate Authentication for FlexNet Inventory Agents
• IIS documentation:
  • IIS Client Certificate Mapping Authentication <iisClientCertificateMappingAuthentication>