Technical Tip: Configuring SSL VPN client certificate authentication to a user/group only

1. Disable 'require client certificate' globally:

2. Enable client-cert under the authentication rule of SSL VPN settings (this option is available via CLI only):

config vpn ssl settings

    config authentication-rule

        edit <no>   <----- User group that should connect with LDAP client certificate authentication.

            set client-cert en <----- Default is disabled.

        next 

end

Note: If the users are using certificate authentication in web mode and 'require client certificate' is disabled globally, then it does not work. To work in web mode, 'require client certificate' should be enabled.

Related document:

Configuring the SSL VPN settings to require a client certificate