This article explain about What PIN Should Be Entered in JSC When Using Certificate-Based Validation with EAP-TLS Authentication

When using EAP-TLS authentication with JSC, the JSC client prompts the user to Enter PIN during the authentication process as shown below:

When EAP-TLS authentication is enabled for JSC, a client certificate is required for user authentication. The PIN requested by the JSC client is the passphrase that was configured when the client certificate was exported in PKCS#12 (.p12) format.

Client Certificate Requirements

- The client certificate must be exported in .p12 format.

- The certificate must be protected with a passphrase. This passphrase will be used as the PIN during authentication.

- The exported certificate file must be named "user.p12".

- Copy the user.p12 file to the following directory on the client machine: C:\ProgramData\Juniper\SecureConnect\certs

Authentication Process

- After copying the "user.p12" certificate to the above directory:

- Launch the JSC client and initiate the VPN connection.

- When prompted for a PIN, enter the passphrase associated with the client certificate.

- JSC uses the client certificate and passphrase to complete EAP-TLS authentication.

If Client Certificate Authentication Is Not Required

If client certificate-based authentication is not required, use EAP-MSCHAPv2 instead of EAP-TLS.

To disable EAP-TLS for the remote-access client configuration, run the following command on the SRX device:

set security remote-access client-config RA-JSC-VPN no-eap-tls

For more information about EAP-TLS authentication, refer to: Certificate-Based Validation Using EAP-TLS Authentication

For more information about EAP-MSCHAPv2 authentication, refer to: Certificate-Based Validation Using EAP-MSCHAPv2 Authentication