> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Site2Cloud Certificate-Based Authentication

> If you want to use certificate-based authentication when establishing a Site2Cloud (external) connection between your Aviatrix gateways, or between an Aviatrix gateway and an external device, you use the CA Certificate tab to:

If you want to use certificate-based authentication when establishing a
Site2Cloud (external) connection between your Aviatrix gateways, or between an
Aviatrix gateway and an external device, you use the CA Certificate tab to:

* Add external device CA certificates
* Download the Aviatrix gateway CA certificate so that you can provide it to the
  external device

The external device CA certificates must be available before you

<a href={"/docs/enterprise/" + "10.1" + "/guides/connectivity/vpn/s2c-configuration-workflow"}>configure the Site2Cloud (external) connection</a>
.

On the external device side, you:

* Obtain the IPsec VPN gateway device certificate
* Export the Trusted Root CA certificate for use in the Site2Cloud configuration
* Import the Aviatrix CA certificate (downloaded from the CA Certificate tab)
* Use the information in the downloaded Site2Cloud configuration file to
  configure your tunnels/interfaces

On the Aviatrix side, you:

* Configure the Site2Cloud connection
  * Select the remote certificate (generated from the external device) when
    prompted
  * Enter the remote identifier when prompted (depends on the external device;
    typically the Remote Identifier is the value of the common name or subject
    field in the VPN gateway device certificate)
* Export the Aviatrix CA certificate
* Download the Site2Cloud configuration you created, to use when configuring
  tunnels/interfaces on your external device

Currently only the <a href={"/docs/enterprise/" + "10.1" +
"/guides/connectivity/vpn/s2c-aviatrixgw-to-paloalto-firewall"}>Palo Alto
VM-Series firewall</a> is supported as an external device.

For information on using certificate-based authentication between two Aviatrix
gateways, see <a href={"/docs/enterprise/" + "10.1" +
"/guides/connectivity/vpn/s2c-aviatrixgw-to-aviatrixgw"}>Aviatrix Gateway to
Aviatrix Gateway</a>.

<a id="adding-ca-cert" />

## Adding a CA Certificate

After you obtain the CA certificate from your external device, you must upload
it on the CA Certificate tab before creating your Site2Cloud (external)
connection.

1. In CoPilot, navigate to Networking > Connectivity > Certificates.
2. Click *+Certificate*.
3. In the Add Certificate dialog enter a unique name for the certificate.
4. Select the CA certificate to upload.
5. Click *Save*.

If you have received an email notification that a CA certificate is about to
expire, or one of the certificates is showing as Invalid on the CA Certificate
list, you use the above procedure to add the new certificate. You must then
delete the expired certificate.

<Note>
  You cannot switch to another certificate after the Site2Cloud connection has
  been created.
</Note>

### Downloading the Aviatrix CA Certificate

You must download the Aviatrix CA certificate and upload it to your external
device (or Aviatrix gateway) for the Site2Cloud connection to work.

1. In CoPilot, navigate to Networking > Connectivity > Certificates.
2. Click *Download Aviatrix CA Certificate*.

### Deleting a Certificate

You must delete a certificate if it has expired. These certificates show as
'invalid' in the CA Certificate table.

<Note>
  You should not delete the certificate while it is in use; this will bring down
  the Site2Cloud connection.
</Note>

Only admin users can delete certificates.

1. Navigate to Networking > Connectivity > Certificates.
2. Click the Delete <img src="https://mintcdn.com/aviatrix-14b37c43/k65bKcXF8onWe87v/images/guides/platform-administration/delete-icon.png?fit=max&auto=format&n=k65bKcXF8onWe87v&q=85&s=4a9bea9e8ad5bd505064d4c0be159385" alt="delete
   icon" style={{display: 'inline', verticalAlign: 'middle', height: '1em'}} width="26" height="26" data-path="images/guides/platform-administration/delete-icon.png" />
   icon next to the certificate you want to delete.
3. (optional) On the Networking > Connectivity > External Connections (S2C) tab:
   1. Select the appropriate gateway and then select *Connectivity Diagnostics*
      from the vertical ellipsis <img src="https://mintcdn.com/aviatrix-14b37c43/mOZ0lmP7pRPIryx3/images/guides/platform-administration/threedot.png?fit=max&auto=format&n=mOZ0lmP7pRPIryx3&q=85&s=6ed1c085429177f16d2735e2406d15c3" alt="25" style={{display: 'inline', verticalAlign: 'middle', height: '1em'}} width="24" height="34" data-path="images/guides/platform-administration/threedot.png" />
      menu.
   2. In the Connectivity Diagnostics Tools dialog, select *IPsec Service* and
      then click *Run*.

This removes the deleted certificate from the gateway cache.

## Limitations

* Only the Palo Alto VM-Series firewall is supported in this version of
  Site2Cloud cert-based authentication.
* Only the Elliptic Curve DSA algorithm (256-bit) is supported in this version.
* Only the PEM certificate file type is supported in this version.
* Validation of PEM certificates that you upload is limited. If a certificate
  contains a malformed base64-encoded block, the upload does not detect or
  reject it. Validate your certificate, for example with OpenSSL, before you
  upload it.
* You can only use one certificate group (all the certificates with the same tag
  name) per Site2Cloud connection.
* You can only roll back the platform version if the previous version supports
  certificate-based authentication (not supported prior to 6.8).
* The Aviatrix UserVPN® feature cannot be used in conjunction with Site2Cloud
  certificate-based authentication.