Skip to content
Docs sslbrain sslbrain.com

Ivanti Connect Secure

Copy link to the page “Ivanti Connect Secure”

← All integrations

Firewall and VPN

Installs the VPN device certificate on selected ports with TLS verification and automatic recovery.

The appliance runs the package and connects to Ivanti Connect Secure through Connect Secure REST API over HTTPS on port 443. No agent is installed on Ivanti Connect Secure.

What happens

  1. The appliance connects to Ivanti Connect Secure through Connect Secure REST API on port 443.
  2. Discovery matches the SHA-256 of the certificate actually served to one device object and explicit port bindings. Discovery reads scoped inventory and also lists VPN bindings using a different certificate from management. Select the precise port as the rule target; ambiguous state permits no changes.
  3. The agent saves the binding restore record and retains previous certificates and private keys on the device. The PEM certificate, key and chain are imported as a separate encrypted PKCS#12 object.
  4. Selecting a service automatically transfers only its selected bindings to the externally managed certificate. The original certificate, previous ACME configuration and schedule, and other services remain. Version and capability discovery select the import and binding path.
  5. A fresh TLS handshake with SNI checks the selected port certificate after activation. Failed activation triggers automatic rollback to the previous bindings and TLS verification of recovery.

Technical details

Connection
The package runs on the appliance, which connects over HTTPS to Connect Secure REST API, port 443. No agent is installed.
Service ports
443
You need
An administrator with REST API access in the selected realm and permission to manage device certificates and port bindings. Admin Users is the default realm. The appliance must reach management HTTPS and the selected VPN ports. TLS uses CA verification or a SHA-256 certificate pin. The CA bundle must trust the supplied replacement chain before import. sslbrain supplies credentials through protected inputs.
Platform
Ivanti Connect Secure 22.x and Pulse Connect Secure 9.1R7+ with REST API, SHA-256 in expanded certificate inventory and explicit port bindings.
Actions
Discovery, Installation, Verification, Rollback
Packages
ivanti-connect-secure-api
Note
  • A normal rule target supplies one discovery ID. Advanced tasks can select multiple ports or a VPN port using a different device certificate with IVANTI_TARGETS_BASE64. The selected certificate is fingerprint-matched before changes. Specify the VPN address, port and SNI when they differ from management.
  • The service selection chooses its certificate management; no additional takeover setting is required. The result lists transferred bindings and their retained predecessor device and ACME certificates; ACME configuration and unselected bindings are unchanged. Refused login is not retried; ambiguous state reports a redacted result without keys or passwords.
  • If the management port adopts the new certificate, save the reported management_pin_after as the pin for later tasks. Verify and rollback use the deployment public restore record; competing changes on selected ports are not overwritten.

Certificate requirements

Keys: sslbrain supplies RSA 2048/3072/4096 and ECDSA P-256/P-384. Ivanti’s 22.7R2 evaluated list also includes P-521. ECC device certificates apply to ISA and virtual appliances and require compatible clients. DSA is unsupported. Universal external-import maxima and older-version size limits are unspecified.

CN: A general external-import CN requirement is not documented. iOS certificate authentication requires the device hostname to match CN. Compatibility with CN-less Let’s Encrypt tlsserver and Google minimal profiles is unspecified for general HTTPS and cannot be assumed for the iOS path.

KU/EKU: The manufacturer sources do not specify whether the device certificate requires clientAuth EKU or keyEncipherment KU. Client-certificate EAP-TLS requirements are not device requirements. Minimal profiles omit these fields; their complete compatibility is unspecified.

SAN: Wildcard device certificates are documented. Android ISAC 22.5.1+ requires the IP address in SAN when connecting by IP. Maximum SAN count is unspecified. The certificate must cover the selected TLS probe name or IP.

Format: Ivanti documents X.509 PEM/DER and PKCS#12 PFX/P12. The agent accepts PEM and builds encrypted PKCS#12 for REST import; JKS device import is not documented.

PFX encryption: The agent defaults to 3DES/SHA-1; AES-256/SHA-256 is selectable. A complete version matrix for 3DES, RC2 and AES is unspecified. A legacy RC2/3DES example does not establish a general AES prohibition.

Chain: Ivanti has a separate intermediate store. The administration guide describes root-first individual import and arbitrary-order whole-file import into that store. PFX chain ordering and root-inclusion requirements are unspecified. The agent preserves supplied order, removes duplicates and changes no trust stores.

Friendly name/alias: The device API examples require no separate alias field. PKCS#12 friendlyName rules and length limits are unspecified.

Validity: The certificate must be currently valid at activation. Numerical minimum and maximum imported lifetimes are unspecified.

Get started