1. Click NO to enable X.509 Certificate. This will reveal additional configuration options and switch to YES, indicating it is enabled.
2. Click Select to upload the Root and Intermediate CA Certificates.

1. Click Local Disk (C:).
2. Click hol.
3. Click SSL.
4. Click CA-Certificate.cer.
5. Click Open.

NOTE: Since this lab only implements a root CA and NOT a subordinate, we will be using only the ROOT certificate during the authentication process. In a real word scenario, you would have ROOT and INTERMEDIATE certificate available, and you must upload both to the Unified Access Gateway Appliance.

Click Save.

After saving, you will see a message that says "Configuration is saved successfully". Once this displays, the certificate has been uploaded and added to the Unified Access Gateway Appliance certificate store.

Select the Gear icon for the intranet Instance

Click More.

Select X.509 Certificate for the Authentication Method.

1. Scroll down to the bottom of the Reverse Proxy Settings window.
2. Click Save.

Click Close.

1. Enter Manage Certificates in the search bar.
2. Click on Manage Certificates.

1. Click the Personal tab.
2. Click Import.

Click Next.

Click Browse.

1. Click Documents.
2. Click HOL.
3. Click Unified Access Gateway.
4. Select All Files (*.*) for the filter.
5. Click corp_local_wildcard.pfx.
6. Click Open.

NOTE: For the purposes of this exercise, any certificate that is trusted by the ROOT certificate you uploaded earlier will be sufficient.

Click Next

1. Set the Password to VMware1!
2. Click Next

1. The Personal Certificate Store will be pre-selected since you choose to upload a Personal certificate.  Do not modify these settings.
2. Click Next.

Click Finish.

1. Click OK to confirm the import was successful.
2. The list of certificates will be refreshed and the *.corp.local certificate will be listed as part of the Personal Store.
3. Click Close.

Normally, you would need to add both the Personal and the Trusted Root Certificate.  However, the Trusted Root Certificate for this infrastructure has already been added, and you will not need to manually included it.

NOTE: Should you wish to view it, you can navigate to the Trusted Root Certification Authorities tab in the Certificates window to find the CONTROLCENTER-CA certificate.

1. Enter https:/uag-internet.corp.local/intranet/ and press ENTER.
2. Select the *.corp.local certificate.
3. Click OK.

You are seeing this prompt because Certificate Authentication is required to visit the intranet site now.  Selecting the intranet.corp.local certificate is choosing to present this user certificate to access the intranet site.

As result, you will see the intranet page which can now only be accessible from the external network for users that present the correct user certificate.

Click Close.