SSL client certificates authenticate clients and encrypt data for SSL-VPN connections. Only authenticated clients can connect to Alibaba Cloud through SSL-VPN. Download and install the certificate on each client.
Prerequisites
An SSL server is created. Create and manage an SSL server.
Create an SSL client certificate
Log on to the VPN Gateway console.
In the navigation pane on the left, choose .
- In the top navigation bar, select the region of the SSL client.
-
On the SSL Clients page, click Create SSL Client.
-
In the Create SSL Client panel, configure the SSL client certificate and click OK.
Configuration
Description
Name
Enter a name for the SSL client certificate.
Resource Group
Select the resource group of the SSL server.
The SSL client certificate must belong to the same resource group as the SSL server.
SSL Server
Select the SSL server to associate with this certificate.
What to do next
Download and install the certificate on your client.
Download an SSL client certificate
Log on to the VPN Gateway console.
In the navigation pane on the left, choose .
- In the top navigation bar, select the region of the SSL client.
-
On the SSL Clients page, find the SSL client certificate that you want to manage and click Download Certificate in the Actions column.
After you click Download Certificate, the browser downloads an archive that contains the CA certificate, the client certificate, the client key, and the client configuration file (
config.ovpn).If nothing happens when you click Download Certificate, or the download link cannot be opened, the browser cache is most likely preventing the page script from running correctly. Try the following steps in order, and then download the certificate and the configuration file again:
-
Refresh the page and click Download Certificate again.
-
Log out of the console, log on again, and click Download Certificate.
-
Clear the browser cache, or open the console in a private or incognito browser window, and then click Download Certificate.
-
Delete an SSL client certificate
Deleting an SSL client certificate disconnects all clients connected to the SSL server. To reconnect, clients must re-initiate their SSL-VPN connections.
For example, if an SSL server has Certificate 1 and Certificate 2, deleting Certificate 1 disconnects all clients using either certificate.
-
Clients that used Certificate 1 must install a different valid certificate and re-initiate an SSL-VPN connection.
-
Clients that used Certificate 2 can reconnect by re-initiating the SSL-VPN connection.
Log on to the VPN Gateway console.
In the navigation pane on the left, choose .
- In the top navigation bar, select the region of the SSL client.
-
On the SSL Clients page, find the SSL client certificate that you want to delete and click Delete in the Actions column.
-
In the Are you sure that you want to delete the client certificates? dialog box, review the impact and click Delete.
Create and manage SSL client certificates by calling API operations
Create, query, and delete SSL client certificates programmatically using Alibaba Cloud SDK (Recommended), Alibaba Cloud CLI, Terraform, and Resource Orchestration Service. Available API operations:
-
CreateSslVpnClientCert - Creates an SSL-VPN client certificate.
-
DeleteSslVpnClientCert - Deletes an SSL-VPN client certificate.
-
ModifySslVpnClientCert - Modifies the name of an SSL-VPN client certificate.
-
DescribeSslVpnClientCerts - Queries the SSL-VPN client certificates that you created.
-
DescribeSslVpnClientCert - Queries details about a specified SSL-VPN client certificate.
FAQ
Does SSL-VPN support assigning a fixed private IP address to a client?
No. Each time a client initiates an SSL-VPN connection, the system dynamically assigns an available private IP address from the Client CIDR Block configured on the SSL server. The private IP address assigned to a client may change after the client disconnects and reconnects. No other method is available to assign a fixed private IP address to a client. If your business requires address-based access control, plan your rules around the client CIDR block instead of individual client IP addresses.
Does a single SSL client certificate limit the number of clients that can be logged on at the same time?
No. Multiple clients can use the same SSL client certificate to log on at the same time, and you cannot restrict a certificate to a single-user logon. The number of concurrent connections is capped by the SSL connection specification of the VPN gateway that the SSL server belongs to, not by the certificate. If you need to distinguish individual users, create a separate SSL client certificate for each user, or enable two-factor authentication on the SSL server.