SSL client certificates authenticate clients and encrypt data for SSL-VPN connections. Only authenticated clients can connect to Alibaba Cloud through SSL-VPN. Download and install the certificate on each client.
Prerequisites
An SSL server is created. Create and manage an SSL server.
Create an SSL client certificate
Log on to the VPN Gateway console.
In the navigation pane on the left, choose .
- In the top navigation bar, select the region of the SSL client.
On the SSL Clients page, click Create SSL Client.
On the Create SSL Client panel, configure the SSL client certificate based on the following information, and then click OK.
Configuration
Description
Name
Enter a name for the SSL client certificate.
Resource Group
Select the resource group of the SSL server.
The SSL client certificate must belong to the same resource group as the SSL server.
SSL Server
Select the SSL server to associate with this certificate.
What to do next
Download and install the certificate on your client.
Download an SSL client certificate
Log on to the VPN Gateway console.
In the navigation pane on the left, choose .
- In the top navigation bar, select the region of the SSL client.
After you click On the SSL Clients page, find the target SSL client certificate, and then click Download Certificate in the Actions column., the browser downloads a compressed package containing the CA certificate, client certificate, client key, and client configuration file (config.ovpn).
If the browser download does not respond after you click Download Certificate, it is usually because the browser cache prevents the page script from running properly. Try refreshing the page, logging out and back in to the console, clearing the browser cache, or retrying in an incognito/private window.
Delete an SSL client certificate
Deleting an SSL client certificate disconnects all clients connected to the SSL server. To reconnect, clients must re-initiate their SSL-VPN connections.
For example, if an SSL server has Certificate 1 and Certificate 2, deleting Certificate 1 disconnects all clients using either certificate.
Clients that used Certificate 1 must install a different valid certificate and re-initiate an SSL-VPN connection.
Clients that used Certificate 2 can reconnect by re-initiating the SSL-VPN connection.
Log on to the VPN Gateway console.
In the navigation pane on the left, choose .
- In the top navigation bar, select the region of the SSL client.
On the SSL Clients page, find the target SSL client certificate, and then click Delete in the Actions column.
In the Are you sure that you want to delete the client certificates? dialog box, confirm the risk warning, and then click Delete.
SSL client certificate expiration handling
An SSL client certificate is valid for three years after it is created.
After the certificate expires, you can directly create a new SSL client certificate without first deleting the old certificate.
The name of the new certificate can be the same as that of the old one; the system does not report an error for duplicate names, and an undeleted old certificate does not affect the normal use of the new certificate.
Create and manage SSL client certificates by calling API operations
You can create, query, and delete SSL client certificates by calling APIs through Alibaba Cloud SDK (recommended), Alibaba Cloud CLI, Terraform, and Resource Orchestration Service (ROS). For more information about the related APIs, see:
FAQ
Does SSL-VPN support assigning fixed private IP addresses to clients?
No. Each time a client initiates an SSL-VPN connection, the system dynamically assigns an available private IP address from the Client CIDR Block configured on the SSL server. After the client disconnects and reconnects, the assigned private IP may change. Currently, no other method can assign a fixed private IP to a client. If your business requires address-based access control, we recommend planning access control rules based on client network segments rather than the private IP of a single client.
Does a single SSL client certificate limit the number of concurrently logged-in clients?
No. A single SSL-VPN client certificate supports concurrent login from multiple clients. Single-user login restriction is not supported, meaning you cannot restrict the number of logins to allow only one client to log in with a single certificate. The upper limit of concurrent connections is determined by the SSL connections specification of the VPN Gateway to which the SSL server belongs, and is unrelated to the number of certificates. If you need to identify access identities per user, we recommend creating a separate SSL client certificate for each user, or enabling two-factor authentication for the SSL server.