topic Re: Export/Import certificates from ASA to FTD in Network Security

Export/Import certificates from ASA to FTD

Chess Norris — Thu, 14 Jul 2022 07:19:52 GMT

Hi,

I'm migrating a multi-context ASA with both identity and CA certificates to a FTD and I wonder what would be the best way to export those certificates from the ASA and then import them to a FTD? I have access to both CLI and ASDM on the ASA, but would prefere using the CLI. In ASDM there is an option to export identity certificates, but not the CA certificates so I guess I need to use a different methods for those?

Thanks

/Chess

Re: Export/Import certificates from ASA to FTD

Rob Ingram — Thu, 14 Jul 2022 07:28:29 GMT

@Chess Norris here is a guide to export the ASA certificate to PKCS12 file. On the FTD you just need to import the PKCS12 file.

Re: Export/Import certificates from ASA to FTD

Chess Norris — Thu, 14 Jul 2022 07:40:52 GMT

Thanks for the quick reply. I'll take a look at this guide.

/Chess

Re: Export/Import certificates from ASA to FTD

Chess Norris — Thu, 14 Jul 2022 08:07:52 GMT

@Rob Ingram While I was able to export/import some of the certificates, the one that are currently associated with RA VPN on the ASA fails. When I'm trying to enroll it on FTD, it gives me an error saying "Fail to configure CA certificate"

Using the exact same method I was able to enroll some other identity certificates, so I am not sure why this one fails. How can I troubleshoot this?

Thanks

/Chess

Re: Export/Import certificates from ASA to FTD

Chess Norris — Thu, 14 Jul 2022 10:52:44 GMT

Followed every step in this troubleshoot guide - Troubleshoot Certificate Error "Fail to configure CA certificate" on FMC , but without any luck. I'm still getting the same error when trying to enroll. It's so strange because the same cert works perfectly on the ASA.

/Chess

Re: Export/Import certificates from ASA to FTD

Rob Ingram — Thu, 14 Jul 2022 12:15:09 GMT

@Chess Norris what is the difference between the certificate(s) that worked and the one that doesn't? Perhaps a key size not supported on FTD/FMC?

Re: Export/Import certificates from ASA to FTD

Chess Norris — Fri, 15 Jul 2022 18:01:51 GMT

I was able to solve the issue by following this guide AnyConnect (FTD), PKCS12, and OpenSSL

I used OpenSSL to associate the CA chain and created a new PKCS12 file. After doing that, I could enroll the certificate in FMC without any issues.

/Chess