We use a browser accessible CRM software in our office. Mainly it is a desktop solution, but with the browser access installed, it is available through https too (self signed certificate). Up till now, We only allowed to access it on the local network, so anyone who wanted to use it from outside connected to our OpenVPN server. The problem is, some users are plain stupid and cannot use the VPN client to connect (even though I made tutorial videos :() and they always forget to disconnect, thus hogging the resources of our servers (more like bandwidth).
Also, the users use stupidly easy passwords (yeah..), so just opening up the site to the outside is not an option. Is there a solution for securing such big security hole? I thought about making something in the middle that would authenticate the users based on a pre-distributed certificate, maybe they can install the certificate once in their browser, but i don't know how secure that would be.
Edit:
The clients use their own personal devices to connect to our servers. Until now, they used OpenVPN, but we would like to stop that method of connection and only allow the website to be used. The website pops up a login page if you open it (uses some kind of SAML2 authentication, requires you to accept two certificates), after that you need to provide a username and password, which is the same as you would use in the desktop application. These password are not secure, too easy to guess and the users don't want to change them. I need an option, where with the smallest possible work, an end user can configure a secure access to this website and after passing that first layer of authentication, can login with his unsecure password.
I can access the website's configuration, but there is not much I can do there regarding this problem. That is why I though of solving this before the website's login page.
(The platform is SAP Business One 9.2 Server, with SAP GateKeeper / Browser Access for B1 9.2. Both the SAP Server and the SAP Browser access is hosted on a Windows Server 2012R2, but on separate machines, the browser access is a virtual one and the SAP Server is a dedicated one. Also we have a pfSense Router)