Generating Client Certificate For P2S

INTRODUCTION

In my previous article, I explained about P2S VPN gateway “Azure Native Certificate Authentication” through Self-Signed Root certificate. The Self-Signed Root Certificate cannot be shared with the end users as it has more privileges. The Child Certificate can be exported from the Self Signed Root Certificate, and the Azure resources can be accessed through this certificate by the end users.

CREATE & EXPORT

• Login to Azure PowerShell.
• Execute the below command to get the P2S Root Certificate details.
  
  Get-ChildItem -Path “Cert:\CurrentUser\My”
  
  

• Run the below command to store the certificate details in a Variable.
  
  $cert = Get-ChildItem -Path “Cert:\CurrentUser\My\*CertificateThumbPrint*”
  
  

• Execute the below command to create a Child Certificate.
  
  New-SelfsignedCertificate -Type Custom -KeySpec Signature -Subject “CN=P2SChildCert” -keyExportPolicy Exportable -HashAlgorithm sha 256 -KeyLength 2048 -CertStoreLocation “Cert:\CurrentUser\My” -Signer $cert -TextExtension @(“2.5.29.37={text}1.3.6.1.5.5.7.3.2”)
  
  
  

• Select the "Exported Certificate" from the File Manager.
  
  
  
  
• Select Action - Action - All Tasks - Export.
  
  
  

• Click "Next".
  
  
  
  
• Select “Yes, Export the private key
• Click "Next".
  
  
  
  
• Select “Personal Information Exchange – PKCS #12 (.PFX)".
• Click "Next".
  
  

• Select the Local Administrator credentials to export the certificate.
  

• Specify the Certificate Name and click "Next".
  
  
  
• Verify the specified details and click "Finish".
  
  

• Click "OK".

Share the exported Certificate with the end-users' PC and install the same under the "Personal Certificate".

Install & connect the VPN Client in End user PC using the below steps.

• Install the certificate on the client machine.
• Login to Azure portal, navigate to Virtual Network Gateways page, and select the P2S gateway.

• Select the “Point-to-site configuration” in P2S gateway settings blade.
• The uploaded certificate will be displayed here.
• Click “Download VPN client” to download & install the VPN client.
  
  
  

• Based on the system configuration (32\64 bit), select and run the setup file.
  
  
  

• Click "Yes" to install VPN client.
  
  
  

• From the system settings, we can see that the VPN is installed successfully.
• Click "Connect" to get connected to the P2S VPN gateway.
  
  
  
  
  
• Click "Connect" in the VPN client window.
  
  
  

• Click "Continue" to grant the elevated privilege to run the VPN client.
  
  
  

• Select the appropriate certificate and click "OK".
  
  
  

• VPN connection has been established successfully.

SUMMARY

In this article, I have explained about creating and exporting P2S child certificate.

The P2S Child certificate can be used by the end users to access Azure Resources. Though the end users can connect to the Azure network and can access the Azure VMs, administrator can restrict RDP access to the VMs through inbound rules in Network Security Group.