How to Install an SSL Certificate on Pulse Secure SSL VPN

This guide gives you step-by-step instructions on how to install an SSL certificate on Pulse Secure SSL VPN, now known as Ivanti Connect Secure.

A note on naming: Pulse Secure was acquired by Ivanti, and the VPN appliance was rebranded. Pulse Connect Secure is now Ivanti Connect Secure (ICS), and the desktop app you may have called Pulse Secure is now the Ivanti Secure Access Client. The admin console and the certificate workflow are the same, so these steps apply whether your appliance still shows the Pulse Secure branding or the newer Ivanti Connect Secure branding.

Generate a CSR code on Pulse Secure

If you have already generated the CSR code and received the SSL certificate by email, feel free to skip Part 1 and jump straight to the installation.

Creating a CSR (Certificate Signing Request) is part of the SSL certificate application process. The CSR is a block of encoded text that contains your contact details, the domain you want to secure, and the organization that owns it. When you generate the CSR, the appliance also creates your private key, which you will need later during installation.

You have two options:

• Use our CSR Generator to create the CSR automatically.
• Follow our step-by-step tutorial on how to generate a CSR in Pulse Secure.

Submit the CSR to your Certificate Authority during the order. Once the CA validates it and issues your certificate, continue with the installation below.

Install an SSL certificate on Pulse Secure

After the CA signs your certificate and sends the files to your inbox, download the ZIP archive and extract its contents on your computer. The exact steps below depend on where you generated the CSR, so follow the path that matches your situation.

If you generated the CSR on Pulse Secure

1. Log in to your Pulse Secure / Ivanti Connect Secure admin console.
2. Navigate to System > Configuration > Certificates > Device Certificates.
3. Under Certificate Signing Requests, click the Pending CSR link that corresponds to the certificate you want to install.
4. At the bottom of the new window, in the Import signed certificate section, click Browse and select the certificate you downloaded (in PKCS#7 or DER format).
5. Click Import.

Tip: after you import a certificate this way, save a copy of your system configuration. Go to Maintenance > Import/Export > Import/Export Configuration and click Save Config As to download the system.cfg file. This backup lets you restore the certificate and its private key if you ever need to.

If you did not generate the CSR on Pulse Secure

If you created the CSR elsewhere (for example, with our CSR Generator), you will import the certificate together with its private key:

1. From the status page of your certificate, click the View certificate button.
2. In the new window, select the desired certificate format (PKCS#7, for example) and download the certificate.
3. Navigate to System > Configuration > Certificates > Device Certificates and click Import Certificate & Key.
4. Choose how your files are packaged, then fill in the fields:
   • Certificate file: the signed certificate you downloaded.
   • Private key file: the key you generated with the CSR.
   • Password: the key or PKCS#12 password, if your file is protected by one.
5. Click Import.

Note: if the certificate and key are combined in a single PKCS#12 file (.pfx or .p12), select that option on the import page and you only need to supply the one file plus its password.

Import your intermediate certificate

To present a complete chain that browsers and clients trust, import the intermediate (CA) certificates:

1. In the admin console, select System > Configuration > Certificates > Trusted Client CAs (on older builds this may be labeled Intermediate CAs).
2. Click Import CA Certificate and browse to your intermediate certificate file.
3. Click Import Certificate.
4. If you have more than one intermediate certificate, repeat the process for each. Installing them in descending order (root first, then each sub-CA) gives the most reliable chain.

Assign the certificate to your Virtual Ports

The final step is to bind your new certificate to the ports that serve VPN traffic, typically your internal and external ports:

1. In your list of device certificates, double-click the old certificate you are replacing.
2. Unbind it from any ports it is assigned to, then click Save Changes.
3. Back in the list, double-click the new certificate.
4. Select and add the relevant internal and external ports, then click Save Changes.

Congratulations, you have successfully installed your SSL certificate on Pulse Secure / Ivanti Connect Secure SSL VPN.

Test your SSL installation

After you install the certificate on Pulse Secure SSL VPN, run an SSL scan against your VPN’s public hostname to check for configuration errors or vulnerabilities. A scan will confirm that the certificate is served correctly and that the intermediate chain is complete. For more details, see our SSL Checker for testing an SSL certificate.

Where to buy the best SSL certificate for Pulse Secure?

SSL Dragon is a reputable SSL vendor with impeccable customer support. We’ve built strong partnerships with the best Certificate Authorities on the market to offer affordable prices across our entire range of SSL products. All our certificates are compatible with Pulse Secure / Ivanti Connect Secure SSL VPN.

Frequently Asked Questions

Bottom line

Installing an SSL certificate on Pulse Secure (Ivanti Connect Secure) comes down to importing your certificate under System > Configuration > Certificates > Device Certificates, adding any intermediate certificates so the chain is complete, and binding the new certificate to your internal and external Virtual Ports.

Need a certificate first? Browse our SSL certificates.