tema SSL ID Certificates not chaining to CA en VPN

SSL ID Certificates not chaining to CA

newtwork1 — Thu, 06 Oct 2011 11:56:46 GMT

**Any thoughts on whether this should have been posted in a different security thread?

I've tried to piece this together with SSL Remote Access VPNS, Understanding PKI and the Cisco's ASA 5500 Series Chapter 73 Configuring Digital Certificates, but still need help.

Below is a basic config I use to create the CA and ID certs on ASAs. I use the ASA as the CA server. When I export the SSL trust point it doesn't show chaining from the CA. Since there is no chaining when I load the CA certificate in the Root Store I still an SSL Certificate error. Instead I have to load the SSL Trustpoint Certificate. Please take a look and let me know where where my problem exists.

CREATE CA

crypto ca server

smtp from-address admin@Cisco.local

lifetime ca 3650

lifetime certificate 3650

lifetime crl 24

keysize 2048

keysize server 2048

no shutdown passphrase 123456789

CREATE SSL ID TRUSTPOINT

crypto ca trustpoint Identity_Certificate

keypair LOCAL-CA-SERVER

id-usage ssl-ipsec

no fqdn

subject-name CN=192.168.40.1,OU=SSL_ANYCONNECT_VPN <--This would be my headend IP

enrollment self

ENROLL TRUSTPOINT

crypto ca enroll Identity_Certificate

answer NO to include the device serial number

SET VPN TRUSTPOINT ON OUTSIDE INTERFACE

ssl trust-point Identity_Certificate outside

I originally thought it was a problem with enrollment self in the trustpoint, but I cannot figure out the steps to complete enrollment terminal.

I got to the steps of crypto ca enroll Identity_Certificate and displayed the certificate request. At that point the sh crypto ca trustpoint Identity_Certificate is pending enrollment. I can not find the command for the CA that allows trustpoint enrollment. If I try to crypto ca export Identity_Cetificate identity-certificateit says trustpoint not enrolled. Of course if I take the enrollment request and attempt to crypto ca import Identity_Certificate certificate it fails because it's not the cert.

Newt

SSL ID Certificates not chaining to CA

Herbert Baerten — Thu, 13 Oct 2011 09:31:29 GMT

Newt,

This is the correct forum, and what you observe is normal. The Local CA is not designed to generate an identity certificate for the ASA itself. The ASA will need to have it's own identity/SSL certificate, which can be either a self-signed one (like you are doing with enrollment self - in this case you need to import the self-signed cert on the clients to avoid certificate warnings) or a certificate issued by a trusted third party (e.g. Verisign, Globalsign, etc.).

hth

Herbert

SSL ID Certificates not chaining to CA

newtwork1 — Thu, 20 Oct 2011 13:50:20 GMT

Herbert,

I appreciate the reponse! So it is not possible to provide chaining from the Local CA to the Identity Certificate.

SSL ID Certificates not chaining to CA

Herbert Baerten — Thu, 20 Oct 2011 13:57:15 GMT

Well, officially, no.

Unofficially (pretend for a moment that you don't see the Cisco logo beneath my name :)) you may get it to work by requesting a certificate on a client (on behalf of the ASA, so using the ASA hostname as the "username" for the certificate), then converting it to base64 format (using OpenSSL for example), then importing it on the ASA.

This would not be something that is supported by Cisco though.

hth

Herbert

SSL ID Certificates not chaining to CA

sharbati.mahdi — Tue, 17 Dec 2013 20:56:32 GMT

Herbert,

I really appreciate your reply; I'v been crazy, 2 days thinking about the same issue..

but you sloved it

thank you

mahdi