topic Re: SSL Certificate on ASA - Missing something? in Network Security

SSL Certificate on ASA - Missing something?

machine23 — Sat, 16 Jan 2021 19:15:04 GMT

Hello All ,

I have added an SSL cert for the ASA - ciscoasa.ladderbar.com (195.36.189.55) and applied the certificate on the SSL settings on the ASA so when users use anyconnect using the DNS name (ciscoasa.ladderbar.com) it works good and no risk message is shown , but when they use the IP it comes up with certificate not trusted message.

Same issue when I browse - https://195.36.189.55 - website shows not secure but https://ciscoasa.ladderbar.com - shows secure.

Any settings on the ASA that i might have missed ?

Thank you

Re: SSL Certificate on ASA - Missing something?

Karsten Iwen — Sat, 16 Jan 2021 20:06:41 GMT

Nothing that you missed here. That's the way it works. The IP address is not part of the certificate and with that not trusted by the client.

Re: SSL Certificate on ASA - Missing something?

machine23 — Sat, 16 Jan 2021 20:20:11 GMT

Ah right okay so I just give the users the the FQDN and leave it at that then .. well that was easy thank you for clarification:)

Re: SSL Certificate on ASA - Missing something?

Mohammed al Baqari — Sun, 17 Jan 2021 07:03:11 GMT

Hi,

No settings on ASA will fix this. You missed to add your ASA IP to the
certificate. Try to regenerate the certificate with CN as
ciscoasa.ladderbar.com and have the IP added to SAN names in the
certificate. This will resolve the issue properly.

**** please remember to rate useful posts

Re: SSL Certificate on ASA - Missing something?

machine23 — Sun, 17 Jan 2021 08:49:16 GMT

Hi , thanks for this , I thought I did put the ip in ... but I will rekey and make sure , also in the fortigates it works without adding the ip in the fortigates.

Re: SSL Certificate on ASA - Missing something?

Karsten Iwen — Sun, 17 Jan 2021 09:05:32 GMT

In my opinion it's not worth the effort to put the IP in the certificate. The CA needs a stricter validation process that you must follow to get the certificate, the certificates are more expensive and if you are using Windows, it will likely not work with older versions than Win10.