topic Re: ASA 5515 in Network Security

ASA 5515

IamDaMayor — Fri, 21 Feb 2020 15:17:28 GMT

Good Day

Is it possible to apply an internal CA certificate to an ASA internal interface and SSL VPN feature?

If so how does one go about doing so?

Re: ASA 5515

Francesco Molino — Mon, 05 Feb 2018 22:49:41 GMT

Hi

Can you give more details on what you're trying to achieve?

Is it having ASA acting as CA server or looking ASA with a corporate CA?

And then leverage vpn authentication with certificates?

Re: ASA 5515

IamDaMayor — Thu, 08 Feb 2018 09:36:57 GMT

When users browses to the management / internal facing IP of the ASA (to access the ASDM) the attached message appears.

How does user apply a certificate to prevent this invalid message appearing ? Users does not want the ASA to be a CA, but would like the ASA to have a Corporate CA cert attached to it. But there are no certificates needed for VPNs at this time

Re: ASA 5515

Francesco Molino — Fri, 09 Feb 2018 02:06:37 GMT

OK got it.

You can create a certificate for ASA. Follow that Cisco doc: https://www.cisco.com/c/en/us/support/docs/security-vpn/public-key-infrastructure-pki/200339-Configure-ASA-SSL-Digital-Certificate-I.html

If you generate a certificate with an internal CA, users must have the chain (root and subordinate) to trust that certificate.

You can also get a public certificate to not get this message for any users...

Re: ASA 5515

IamDaMayor — Fri, 09 Feb 2018 07:14:01 GMT

User has already tried using that link but as per user it was not helpful

User would like to apply an internal cert to the management interface (used on the internal network).

Re: ASA 5515

Francesco Molino — Fri, 09 Feb 2018 15:15:21 GMT

I'm sorry but I don't understand your issue here.

The link is talking about importing a certificate on ASA (no matter if that's a public or internal CA).

The goal is to :

- create a trustpoint

- authenticate that trustpoint by importing your Root CA

- Use openssl to generate your ASA cert

- import the cert into ASA.

Steps are the same for internal certificate or external certificate