Certificate Authentication

A Microsoft Internet Security and Acceleration (ISA) Server 2000 VPN operating over the Internet requires X.509 server certificates for authentication. You need a certificate for each ISA Server and client. To establish a VPN, participants must trust the root Certificate Authority (CA) or CAs that issue the certificates.

If all endpoints are members of the same domain, consider installing Microsoft Certificate Services and using autoenrollment to ease certificate distribution. Installing Certificate Services and generating usable enterprise certificates can be challenging; read the Microsoft article "Step-by-Step Guide to Setting up a Certification Authority" for details. If participants are in different domains, you'll need to acquire third-party certificates from a trusted root authority, such as VeriSign. You won't need to set up Certificate Services or generate certificates, which makes life easier on the front end, but you'll face more labor during certificate distribution, when each machine requests and installs a certificate. . . .