topic Thanks for the info, it in Network Security

AnyConnect/SSL using wrong certificate

erikorrsjo — Tue, 12 Mar 2019 07:12:36 GMT

Hello

I have a Cisco ASA5508 and have set up for AnyConnect.

I have installed a GlobalSign certificate properly:

GOTFW001(config)# show ssl
Accept connections using SSLv3 or greater and negotiate to TLSv1.2 or greater
Start connections using TLSv1.2 and negotiate to TLSv1.2 or greater
SSL DH Group: group5 (1536-bit modulus)
SSL ECDH Group: group19 (256-bit EC)

SSL trust-points:
Self-signed (RSA 2048 bits RSA-SHA256) certificate available
Self-signed (EC 256 bits ecdsa-with-SHA256) certificate available
Interface internet: ASDM_TrustPoint1 (RSA 2048 bits RSA-SHA256)
Certificate authentication is not enabled

But when I connect to the portal through the internet interface I get certificate error and when checking it I can see that the self-signed certificate is used. Why is that? Anybody got any ideas?

Regards,

Erik

Dear Erik

vincent.monnier — Thu, 28 Jan 2016 16:12:35 GMT

Dear Erik

Have you set in your configuration a command such as :

ssl trust-point theRightTrustPoint

Where theRightTrustPoint is the trust point for your GlobalSign certificate

Regards,

Vincent

Hi Erik,

Shivapramod M — Thu, 28 Jan 2016 16:33:17 GMT

Hi Erik,

Are you using the firewall version 9.4.1 or above. If yes then you will see that self signed certificate will be used. This is an expected behaviour.

When the client sends an SSL hello packets, an elliptic curve-capable SSL negotiation is used in version 9.4, and the ASA will present the SSL VPN client with an elliptic curve certificate, even when the corresponding interface has been configured with an RSA-based trustpoint. That's why the ASA is presenting the self-signed Cert "Self-signed (EC 256 bits ecdsa-with-SHA256)".

So To avoid this, we need to remove the corresponding cipher suites using the ssl cipher command.
we can execute the following command so that only RSA based ciphers are negotiated (

ssl cipher tlsv1.2 custom "AES256-SHA:AES128-SHA:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:DES-CBC3-SHA:DES-CBC-SHA:RC4-SHA:RC4-MD5"

Please refer the below documents.

http://www.cisco.com/c/en/us/td/docs/security/asa/asa94/release/notes/asarn94.html

https://supportforums.cisco.com/discussion/12524736/asa-x-ios-941-anyconnect-windows-81-untrusted-vpn-server-blocked

Thanks,
Shivapramod M
Please remember to select a correct answer and rate helpful posts

Thanks for the info, it

erikorrsjo — Fri, 29 Jan 2016 20:05:04 GMT

Thanks for the info, it helped!

Erik