topic Re: Anyconnect Client SSL authentication with Windows CA in Network Security

Anyconnect Client SSL authentication with Windows CA

sanchezeldorado — Thu, 08 Dec 2022 00:12:04 GMT

Hello,

I have am using FMC and FTD version 7.2 and I have a working configuration using SAML authentication. I'm trying to add Certificate authentication, but I'm having a problem validating the certificate installed on my client machine. First a couple facts.

1. I have a windows CA that has pushed out computer certificates to all of my domain computers.
2. In my remote access vpn config, I have installed a public certificate vpn.mydomain.com.

I believe my problem is that the FTD is trying to match the public cert with my computer's private cert and giving me an error "Certificate Validation Failure". Is there a way to present the vpn.mydomain.com website with a public certificate while my clients use the private cert? I plan to add another connection profile for vendors and I don't want to require certificates for them.

Thanks!
Andy

Re: Anyconnect Client SSL authentication with Windows CA

Milos_Jovanovic — Thu, 08 Dec 2022 08:48:42 GMT

Hi @sanchezeldorado,

Yes, it is possible to use public CA signed certificate for your FTD devices, to identify FTD on the Internet, and at the same time to use private CA signed device certificate, to identify clients to your FTD. You can see config guide here.

Based on your error desciption, it looks to me like your FTD doesn't have private CA chain, so it can't validate client certificate, or client is not using private CA certificate to identify itself, so FTD doesn't trust offered one.

Kind regards,

Milos

Re: Anyconnect Client SSL authentication with Windows CA

sanchezeldorado — Sun, 11 Dec 2022 15:05:42 GMT

Thank you for the input. Unfortunately, it looks like I won't have the ability to get this configured. Have a good day!

Re: Anyconnect Client SSL authentication with Windows CA

BURKHARD LANDWEHR — Wed, 03 Apr 2024 12:36:45 GMT

I have the same Problem on a FTD managed by FDM, I installed the root & servercertificate from MS CA. Also I installed it onthe client PC but the result is allways Certificate Validation Failure... Any idea????