topic Re: Question regarding CA cert being added to FMC in Network Security

Question regarding CA cert being added to FMC

NetworkMonkey101 — Thu, 19 Sep 2024 07:54:18 GMT

Hi have exported a CA cert from my ASA and added to objects > PKI > cert enrollment. When added I then went to devices >certs and generated the CSR to be signed but the cert issued against the CSR has only hostname ‘firepower’ rather than FW-HOSTNAME-01. Do you need to set a hostname specific for this device? And if so how do I do that?

Re: Question regarding CA cert being added to FMC

Rob Ingram — Thu, 19 Sep 2024 08:00:33 GMT

@NetworkMonkey101 refer to the manual enrollment section in the Cisco guide when generating the CSR.

https://www.cisco.com/c/en/us/support/docs/security-vpn/public-key-infrastructure-pki/215849-certificate-installation-and-renewal-on.html#toc-hId--287505925

Re: Question regarding CA cert being added to FMC

NetworkMonkey101 — Thu, 19 Sep 2024 08:12:05 GMT

Do I need to create one of these for each firewall?

Re: Question regarding CA cert being added to FMC

Rob Ingram — Thu, 19 Sep 2024 08:18:15 GMT

@NetworkMonkey101 probably if you need unique certificates, it depends on the usage.

Re: Question regarding CA cert being added to FMC

NetworkMonkey101 — Thu, 19 Sep 2024 08:21:56 GMT

Doing a ASA to FTD migration and wanting to migrate the certs for user with RAVPN and IPSEC

Re: Question regarding CA cert being added to FMC

Rob Ingram — Thu, 19 Sep 2024 09:03:47 GMT

@NetworkMonkey101 how many certificates did you have before? Did multiple applicances share certificates, i.e., wildcard or multi-domain etc?.

If you do already have a wildcard you wish to import to another FTD you don't need to create a CSR, navigate to Objects > Object Management > PKI > Cert Enrollment, Add New Cert Enrollment. Select the Enrollment Type as PKCS12 and import the file, entering the passphrase. Then go to Devices > Certificates and add the certificate to the FTD.