topic Re: SSL Certificates for AnyConnect VPN in Network Security

SSL Certificates for AnyConnect VPN

Heino Human — Thu, 28 Jan 2021 00:01:59 GMT

Hi guys,

I'm a bit confused in why we would use two signed certificates for anyconnect VPN to establish a trust point on the outside interface of the firewall. If look at the below article and follow the steps, it would go like this.

1. Create a CSR on the FTD via CLI

2. Send it to a CA to be signed

3. Go to Objects > Object Management > PKI > Cert Enrollment, click on Add Cert Enrollment. Here we add the CA signed certificate (which is the first one)

4. Then we go to Devices > Certificates > Add > New Certificate. Here we select the cert enrollment we did in step 3, create another CSR to be signed by a CA again.

https://www.cisco.com/c/en/us/support/docs/network-management/remote-access/212424-anyconnect-remote-access-vpn-configurati.html

Am I reading this incorrectly or not understanding the process?

Any insight would be amazing so I can get my head around this.

Thank you

Heino

Re: SSL Certificates for AnyConnect VPN

Omar Sandoval — Thu, 28 Jan 2021 00:20:12 GMT

Hi,

Step 3 is for upload the certificate signed by the CA, and the step 4 is to assign the certificate (uploaded on step 3) to FTD.

Re: SSL Certificates for AnyConnect VPN

Heino Human — Thu, 28 Jan 2021 02:45:16 GMT

Hi Omar,

That is correct, though when you assign the certificate in step 4, a new CSR is raised. Please see the screenshots attached.

Thank you

Heino

Re: SSL Certificates for AnyConnect VPN

Panos Bouras — Thu, 28 Jan 2021 18:08:06 GMT

@Hi @Heino Human

I create the CSR outside FTD (try openSSL) and then import the certificate to FTD

Check the following guide, I use the PKCS12 option.

https://www.cisco.com/c/en/us/support/docs/security-vpn/public-key-infrastructure-pki/215849-certificate-installation-and-renewal-on.html

Re: SSL Certificates for AnyConnect VPN

Rob Ingram — Thu, 28 Jan 2021 18:24:16 GMT

@Heino Human

You are getting confused between 2 different methods to import a certificate.

|You generate the CSR via openssl from the CLI, sign the certificate and create a PKCS12 file. On the FMC you then you select the Certificate Enrollment type as PKCS12 and import the file (this doesn't generate a new CSR). Example

Another method is select the Certificate Enrollment type as Manual, import the CA certificate and then generate the CSR and import the signed file. This method does not require you to generate a CSR on the CLI.