XoT-Clients
The certificate on a key that cannot be copied
XoT-Clients sign in with a digital certificate. The certificate can be stored on a YubiKey or a smart card. Then access to the user's computer is not enough. Anyone who wants to connect also needs the key and the PIN.
Why
Two factors in every sign-in
The private key that belongs to the certificate is stored in the hardware key. It cannot be read out from there. The user must have the key and know the PIN. That is two factors: something you have and something you know.
So a stolen computer is not enough to connect. If a key is lost, the administrator revokes the certificate in the XMS. Access you revoke stops working in the Lock immediately.
Support
Keys and cards that work
| Type | Examples |
|---|---|
| Hardware key | YubiKey from Yubico |
| Smart cards | Thales ID series and Net iD |
| Other smart cards | Through OpenSC |
| Certificate in a file | When no hardware key is available |
The client uses the PKCS#11 standard. We recommend a hardware key rather than a certificate in a file.
How it works
From a certificate in the XMS to a key in the user's hand
- The certificate is created in the XMS. The root certificate can be in the XMS or in an external certificate authority you already have.
- The XoT-Desktop Client writes the certificate to the user's YubiKey or smart card.
- The user signs in with the key and the PIN every time they connect.
The customer's IT department usually manages the YubiKeys. Access cards that are also smart cards are often managed by the security department.
Common questions
Can we use the certificate authority we already have?
Yes. The root certificate can be in an external certificate authority instead of in the XMS.
Can we use our access cards?
Yes, if the cards are smart cards the client supports. Ask us if you are unsure which cards you have.
Does YubiKey work for servers and machines?
No. A YubiKey requires a PIN, and the client for servers without a screen cannot take one. That client uses a certificate in a file, Net iD or OpenSC instead.
Do you already have YubiKeys or smart cards?
Tell us which keys or cards you use, and we will show you how they work with XoT.