Cisco VPN :: 5510 - Certificate Validation Failure With AnyConnect Only On MAC
Apr 2, 2012
I have an anyconnect account set up using version 3.0.5080 and connecting to an ASA 5510 base 8.2(2)17. We are using certificates for authentication. If I try and use the account on a windows machine it all works fine.
However on a mac running Lion if I try and connect via a web browser or already have the anyconnect client loaded and try to connect I always get “certificate Validation Failure”. I double checked the certificate was correct and am sure that is correct as it is the same certificate on the Windows and the mac. After searching online I have also tried editing the anyconnect profile to so it is set “certificate store override”, and put the certificates and key in the “user/.cisco/certificates” and “/opt/.cisco/certificates” folders.
After further testing, if I change the anyconnect connection profile to “authentication aaa” I can connect fine. Then if I disconnect, change it back to “authentication certificate” I can connect fine the first time, but all the following subsequent efforts I make fail. If I repeat this process this happens each time, I can connect the first time but after that it fails with the same “certificate Validation Failure” error message. When it connects this first time I checked and confirmed that it is definitely using the certificate. I have also tried using both authentication methods (“authentication aaa certificate”) and had the same problem.
This leads me to believe that my configuration is correct and it is some bug in the anyconnect client or the ASA image. I have had a look through bugs and read somewhere that there was a bug on earlier versions of 8.4, but nothing about 8.2.
View 1 Replies
ADVERTISEMENT
Mar 21, 2013
I have an ASA (8.4.5) configured with a connection profile that does AAA and Certificate authentication. Once I have the anyconnect 3.1 on a win Xp system, it works perfectly. When I do a web install, it goes through the normal download, log-in, re-download then says "Certificate Authentication Failure" If I change the profile to AAA only, it installs fine. I even get the error if I launch from the web after I have the client on the PC. Why this is not working?
View 3 Replies
View Related
Oct 25, 2009
Tried configuring SSL VPN using Certificate authentication using a Microsoft CA server. Truspoint created and mapped to SSL VPN. While connecting the SSL VPN getting certificate validation failure. find the error screen shot attached
View 4 Replies
View Related
Jan 30, 2012
There is ASA with remote access VPN and users are authenticated using third party signed certificates (CA is not local in ASA).When user certificate expires i can see it in syslog messages. For example:
%ASA-3-717009: Certificate validation failed. Certificate date is out-of-range, serial number: (...)
I would like to know if there is an opportunity to view user's certificate expiry date beforehand, say, 3 days before?
View 3 Replies
View Related
Dec 2, 2011
Can anyconnect clients and cisco vpn ikev1-2 clients use the same certificate on an ASA 5510 ?
View 4 Replies
View Related
Dec 26, 2012
I have configured an Asa 5510 as SSL vpn gataway ver 8.2(4) Anyconnect Essential. The clients are authenticated via Radius and OTP password.All work well since yesterday. When I have did same configuration changes. My objective was has that the clients accept the self signed certificate issued by the Asa whitout give the warning about the private cert.
So I have try to generaste a new certificate with FQDN equal to myasa.mydomain.com and also a CN=myasa
Then I have change the profile XML file of my anyconnect in this way: [code]
View 1 Replies
View Related
Sep 20, 2011
ASA 5510 configuration for Csco anyconnect vpn client. Currently ASA is configured for self-signed certificate acces thru anyconnect ssl vpn. So the cert is being generated with every connection (of my understanding, I haven't found any identity certificate on the current configuration, at least on ASDM). Now I need to use a certificate from our local windows CA that we have at the office. I.e. self-signed certs should be changed with another one issued by our local office authority.
1. Generated new rsa key pair on the ASA
2. Generated CSR from identity certificates
3. Applied CSR to the windows CA and generated the certificate
Now I need to understand what is going to happen after I install this certificate on the ASA's identity certificates and apply it to outside interface. Is there anything to be done on the users side to use new certificate? Do they need to download and install the root certificate from the same CA? Do i need to have the root certificate installed on the ASA or identity is enough?
View 1 Replies
View Related
Mar 14, 2013
I'm currently having issues testing OCSP servers for certificate validation on ACS 5.4. Server team claims everything is fine on their side, but all attempts result in the following error:12562 OCSP server response is invalid
I've already tried to disable NONCE extension support and signature validation, which hasn't really had any effect. How to debug OCSP processing or look into the problem more precisely another way?
View 7 Replies
View Related
Dec 20, 2012
I am doing a proof of concept with anyconnect and certificate authentication. with 3.0 i was able to do this with a certificate from my CA and a client cert in a smartcard. I have upgraded to 3.1 and now it doesnt work anymore ( i need 3.1 and Asa 9.0 because of IPv6 Split-tunneling).Reading the forum i got some info that the ASA cert must have a EKU value of 'Server Authentication' and the client cert must have a similar EKU (client Auth)
View 4 Replies
View Related
May 22, 2011
My company just upgraded our VPN software to use Cisco AnyConnect 3.0.1047. We were previously using 2.5.0217. I successfully upgraded the VPN client on my iMac. I am trying to do the same on my MacBook Pro but the process is failing. Both Macs are using OSX 10.6.7. Both use Chrome but I have reproduced the error using Safari and Firefox on the failing system.
On the failing MacBook, the IP address my IT department gave me produced this error:After the 26 second timeout completed, I was brought to this screen:
I clicked the "Mac..." link above and a file called "cstub" was downloaded. I could not execute the file directly as its permissions started at 644. I changed its permissions through the terminal to 755. I tried executing the binary but it failed returning error code 250.I tried uninstalling AnyConnect 2.5.0217 to see if that improved things. No change.
View 3 Replies
View Related
Apr 28, 2013
I have a strange issue with certificate based authentication anyconnect. We have an ASA with two internet links, both have a CA authenticated Cert for anyconnect VPN’s. We have an anyconnect client profile also, when we simulate a link failure on the ASA the anyconnect should automatically attempt a re-connect to the backup server list in its configuration (which is the other interface on the ASA 5580) which it does but we get a certificate trust error.
View 3 Replies
View Related
Sep 6, 2011
When i'm trying to connect using stand-alone Anyconnect (not through the web), I got the SSL error message "The certificate you are viewing does not match the name of the site you are trying to view" (attached).
The certificate I installed for the SSL connection on outside interface got Subject CN=testvpn.mydomain and Subject Alternative Name (SAN) --> DNS Name = testvpn.mydomain
It seems to me that instead of connecting to testvpn.mydomain, anyconnect try to connect to the its IP address. I did try to remove the IP address in Server List in the profile, but it still doesn't work.
If I'm using Clientless (through browser), I don't received this error which means the certificates installed correctly.
Is that a bug on anyconnect 2.5.2019 or is there other ways to force anyconnect to check name instead of the IP against the certficate?
View 4 Replies
View Related
Mar 26, 2012
We currently are using the anyconnect client using certificates for authentication (ASA 5520 v8.4). It works pretty good but I can only get it to work on a profile basis on the clients laptops. We are running windows 7 and if multiple users need VPN i have to install the certificate for each user. I have changed the xml profile to read the certificate store to "all" and true for certificate store override. I am installing the certificate in the trusted root certificate store. Is there a way for the anyconnect to authenticate for all profiles (users) for the laptop?
View 0 Replies
View Related
Feb 7, 2013
I am having some problems with my AnyConnect configuration.I have configured AnyConnect (ssl vpn / webvpn) on my Cisco 1841 Router, and I can access it from a web browser and start the tunnel, then anyconnect starts up and then the problem come, because when AnyConnect is trying to connect it comes with an error saying "The certificate on the secure gateway is invalid".
I have read almost all of the threads in here about the problem also tried to make a new certificate, but nothing is working?
BTW: I am using self-signed certificate?
View 5 Replies
View Related
May 28, 2012
I am setting up Clientless Anyconnect on ASA 5520. I have a Verisign Cert but when I go to Certificate Management-->CA Certificates-->Add, I put everything in and click "install certificate" I get an error. FYI I have the Primary Cert Authority Installed already?
View 1 Replies
View Related
Oct 25, 2012
I just upgraded our AnyConnect package on our ASA5510 from 3.06xxx to 3.1. When I tried to log in to the website to automatically install the client, it showed me a big error saying the Certificate is untrusted and I have to explicitly accept it. After accepting it, I had to restart the installation.Is there a way to disable this strict certificate trust setting? We don't have a valid SSLVPN certificate yet, but this big error will confuse endusers.
View 8 Replies
View Related
Aug 19, 2012
we currently have a remote access asa setup using Anyconnect with self signed certificate, and several users in the certificate database as we are using radius and certificate for authentication.
I want to purchase and obtain a trusted CA signed certificate (such as Verisign) and replace the current self signed cert.
My question is will I have to reset the current CA server of the ASA and replace the certificate user database? ie start from scratch.
View 2 Replies
View Related
Jan 22, 2012
I want to connect with AnyConnect Secure Mobility Client 3.0.2052 to ASA 5540 Version 8.4 and SSL Premium License.The clients using Maschine Certificate to authenticate to ASA. This works fine.Now I want to setup a DAP to verifiy the client against the Microsoft AD using LDAP. I configured LDAP server in ASA see:aaa-server LDAP protocol ldap aaa-server LDAP (inside) host ldap.com ldap-base-dn DC=x,DC=x,DC=x,DC=com ldap-scope subtree ldap-login-password ***** ldap-login-dn ***** server-type microsoft ,I can see that it works if I test the server via the testbotton in ASDM and I see it in CLI "debug ldap 255" also. But if I configure in DAP: AAA Attribute ID:memberOf = DomainMember I can not see any request to the LDAP server during I try to connect with the Client und the DAP doesn't match.
View 2 Replies
View Related
Jan 25, 2012
I'm trying to set up vpn with ASA 8.2(5) and Anyconnect 3.0.4235. The goal is to force user to connect from registered machines only (winXP & win7 x32 and x64). To do this, I used machine certificates issued by own CA. Certificate is installed in machine store. I use double authentication (aaa & certificates). Everything works fine, AnyConnect browses cert store, ASA validating machine certificate, then user is prompted for username/password and finally if all is correct - connection is established.My problem is, that for new installation (new host), AnyConnect fails at first connection attempt. If I use aaa authentication only, connection is established, but if I use aaa & certificates - connection fails. The appropriate .xml profile is predeployed at client host asa well as machine and root certificates.Important: When first try (aaa auth) succeded, others are always OK (with aaa. certificate or aaa & certificate authentication). Only the first one fails.The goal is to succesfuly establish connection with aaa & cert.
With DART i get:
******************************************
Type : Error
Source : acvpnagent
Description : Function: CTransportWinHttp::WinHttpCallback
File: .CTransportWinHttp.cpp
Line: 2150
[code]....
Certificate is valid for sure, and as I mentioned before, if first use aaa only, the second try is OK. At ASA with debug crypto ca 255 can't see any certificate from client.
View 3 Replies
View Related
Jul 7, 2011
Any instructions to configure an ASA to allow authentication by certificate only on an AnyConnect vpn?I'm running an ASA 5505 with 8.4(1) and AnyConnect 2.4.7030 on an Android phone.I currently have the AnyConnect client connecting ok using username / password for authentication.
I have loaded the company root certificate (internally generated) into the ASA "CA Certificates" and generated an Identity Certificate for the ASA.
View 1 Replies
View Related
Jul 13, 2011
want to connect with AnyConnect Secure Mobility Client 3.0.2052 to ASA 5540 Version 8.4 and SSL Premium License.The clients using Maschine Certificate to authenticate to ASA. This works fine.
Now I want to setup a DAP to verifiy the client against the Microsoft AD using LDAP. I configured LDAP server in ASA see: [code]I can see that it works if I test the server via the testbotton in ASDM and I see it in CLI "debug ldap 255" also. But if I configure in DAP: AAA Attribute ID:memberOf = Domain Member I can not see any request to the LDAP server during I try to connect with the Client und the DAP doesn't match.
View 3 Replies
View Related
Apr 17, 2013
I am having anyconnect version 3.1.03103, windows7 & 8 and asa 5520 (8.4). I have gone through alot of work to solve this issue but it not hapening. On clientless ssl vpn it prompts me for manual certificate selection but on anyconnect client it is not. profile configuration is mentioned below. In the highlighted line below i have changed UserControllable="true" still no results.
<?xml version="1.0" encoding="UTF-8"?>
-<AnyConnectProfile xsi:schemaLocation="[URL]" xmlns:xsi="[URL]" xmlns="[URL]">-<ClientInitialization>
[Code]....
View 0 Replies
View Related
Dec 12, 2012
It appears we had a vendor setup an SSL certificate for our vpn. I see it under the ASDM on configuration -> device management -> Certificate management -> identity Certificates
there is the certificate there and I also see it pointing to the outside under configuration -> device management -> advanced -> ssl settings and under outside the primary enrolled cert is the ssl cert.
only thing i can see which may be incorrect is if i look at the cert details under indentity certificates and select issued to the url says http not https..
View 3 Replies
View Related
Oct 8, 2012
I'm currently dealing with a problem related to the integration between the a Cisco ASA 5510 and an AD Microsoft CA on a windows2008R2. I'm basically trying to enroll the ASA in the CA and get a certificate for the ASA to use for SSL VPNs. I'm using SCEP enrollment and I've set up NDEP on the Win2008 CA.
Everything seems to be working just fine and I get the certificate but If I assign it to the interface, first the client receives a warning and then a blank page is shown (everything works just fine with the ASA self-signed certificate). The problem looks like to be related to the purpose of the keys (key usage field) which is not Server authentication. The certificate is automatically generated using the IP Sec (offline) template.
View 3 Replies
View Related
Aug 1, 2012
I'm changing SSL VPN from aaa authentication to both aaa and certs, Server 08 CA, 8.2 ASA 5510, ssl client 2.5.1025 and Windows 7 users. My question is what should be the template of the id cert that I receive from CA. ,
View 16 Replies
View Related
Apr 9, 2013
I have an ASA 5510 Try to add a new certifcate to the exsiting trustpoint or create a new trustpoint and migrate my VPNs over to that.
View 1 Replies
View Related
Jun 3, 2012
Do you know the procedure of import SSL certificate from Godaddy to ASA 5510? attached is the drop-down list that I have to choose from.
View 5 Replies
View Related
Nov 14, 2011
Some times the ISP side interface remains up with a failure of internet. At those situation how we can efficiently track the ISP failure from asa 5510
View 2 Replies
View Related
Apr 21, 2012
We have purchased "True BusinessID certificate" from Geotrust for our SSL VPN. Geotrust issued 2 certificates such as Web Server CERTIFICATE & INTERMEDIATE CA.
SSL vpn is being configured in Cisco ASA 5510 software version 7.2(3). Now we could successfully install INTERMEDIATE CA successfully to ASA but Web Server CERTIFICATE cannot install and gives the following error
*Failed to parse or verify imported certificate*
We followed this link to install the certificatesURL
We contacted geotrust regarding this errror and they suggest to install GeoTrust Root along with the Primary & Secondary Intermediate CA certificates for True BusinessID certificate. URL
1. How to install Root along with the Primary & Secondary Intermediate CA certificates on our Cisco ASA 5510 version 7.2(3) . is there any proper way to install certificate i mean ROOT--intermediate--identify ?
2. Have we seleted the exact SSL certificate from Geotrust for our SSL VPN? is there any other certificate we should get it from Geotrust?
View 7 Replies
View Related
Apr 18, 2012
I'm trying to export identity certificates from an ASA 5510 to 5520, I'm exporting in pkcs12 format and specifying a passphrase. When attempting to import to the 5520, I get "error import pkcs12 operation failed" from cli or asdm.
View 1 Replies
View Related
Jun 13, 2013
How to Generate a CSR File to Renew out SSL Certificate on ASA5510 v9.0(2) - ASDM v 7.1(2) ?
View 1 Replies
View Related
Apr 3, 2012
I am facing problem connecting via vpn to my asa5510 using anyconnect.My anyconnect client shows "network access: unavailable - no networks detected" before i attempt to establish my vpn.Upon establishing vpn, i was prompted username and password which went through but i was given the error "anyconnect was not able to establish a connection to the specified secure gateway. Please try connecting again".I face this problem after replacing my pc. I was able to connect without problems on my previous pc.The vpn connection uses cert which i have already import to my new pc and authentication is fine since no authentication error. No changes made on my firewall.
View 1 Replies
View Related
May 23, 2012
I have an ASA 5510 I'm trying to use as an SSL VPN provider. I have Anyconnect windows and mobile licenses from Cisco. I'm looking for a straight forward configuration guide to use. Right now I only need to iPhone and Android clients to work with the VPN, but in the future we might add windows clients.
I was going to use this guide: [URL]. Until I talked to Cisco tech support, they recommended I use the following:[URL] Which is a lot longer and a bit unclear about the whole process, and also points me to this guide:[URL]Which is longer still, and not applicable for the most part.So, what's going to be the best guide to use? Did I have it right the first time? Do I need to go to another site to find something?
View 1 Replies
View Related
