topic Associated Trustpoints question when installing identity certificate via ASDM in Network Security

Associated Trustpoints question when installing identity certificate via ASDM

faghouri83 — Fri, 21 Feb 2020 15:59:25 GMT

Hi everyone

Im upgrading the firewall hardware. I saved the identity certificates from the old firewall and then I took a screenshot of the ASDM which has the identity certificate information.

I then realised that one of the certificates has more than one associated trustpoint in the screenshot. I can see one trustpoint then a comma and then i cant completely read the second associated trustpoint.

I no longer have access to the ASDM but i can get hold of the config file. I want to try to add the identity certifiacte via the ASDM as i'm more comfortable with it.

My question is, is there any way i can find out what the second associated trustpoint is from the config file? If i can, is it possible to just add the ID cert via ASDM by entering the certificate name as the two associated trustpoints separated by a comma?

thanks

Re: Associated Trustpoints question when installing identity certificate via ASDM

Dennis Mink — Mon, 16 Jul 2018 13:49:24 GMT

what are you using the certs for? just for ASDM?

also, exporting the cert is not enough, you will need to export the private and public RSA keys as well.

imho, you will ne better off generating new keys and subsequent cers

Re: Associated Trustpoints question when installing identity certificate via ASDM

faghouri83 — Mon, 16 Jul 2018 14:22:52 GMT

Hi Dennis

When you save the identity certificate from the old firewall isnt the rsa key included?

the certificate will be used for remote access vpn

thanks

Re: Associated Trustpoints question when installing identity certificate via ASDM

Dennis Mink — Mon, 16 Jul 2018 20:45:58 GMT

NO, saving a cert is not the same as saving key, those are two distinctly different things.

however,

try this:

https://www.fragmentationneeded.net/2015/04/exporting-rsa-keys-from-cisco-asa.html

the PKCS does include the private key.