# Certificate-based authentication

> Configure public key infrastructure (PKI) so users can authenticate to Cloud Management Platform (CMP) with client certificates

---

Site [llms.txt](/llms.txt)

---

## Configure PKI in the Cloud Management Platform (CMP) web interface

1. Turn on the Database Browser: add `ENABLE_DB_BROWSER = True` to `/var/opt/cloudbolt/proserv/customer_settings.py`, then run `systemctl restart httpd`.
1. Log in to CMP as an admin user.
1. Go to **Admin** > **Database Browser**. On that page, find the Utilities section and select **Add** in the PKIUtilities row.
1. Enter regex expressions that evaluate to the username, first, last, and email fields based on the Subject (or DN) field in the user certificates your company uses.
1. Optionally, determine which groups the new users should have requestor, approver, and other roles in.
1. Save the form.

## Configure PKI in CMP's server settings

Edit `/var/opt/cloudbolt/proserv/customer_settings.py` and append the following section:

```bash
# Enable PKI section
LOGIN_URL="/pki/login/"
```

## Configure Apache to require client certificates for the `/pki/login` URL

1. Use `scp` to copy the root CA certificate to the CMP server. This article uses `/var/opt/cloudbolt/proserv/ca.crt` as the certificate path.
1. Edit `/etc/httpd/conf/httpd.conf`, adding the following section:

   ```bash
   <Location /pki/login>
       SSLCACertificateFile /var/opt/cloudbolt/proserv/ca.crt
       SSLVerifyClient require
       SSLVerifyDepth 5
       SSLOptions +StdEnvVars
   </Location>
   ```

   If you are using an intermediate CA certificate, use the **SSLCertificateChainFile** directive instead of **SSLCACertificateFile**.

1. Restart httpd.