Cisco ACE certificate and public key mismatch

[Ji-Won Park]

Hello,

I was wondering if anyone had a similar issue....

What would be the possible cause of the SSL certificate and public key mismatch during the verification process? The CSR was sent to the external vendor to sign and we are trying to install it on ACE now, but the verification fails. Trying to regenerate the certificate.

Please let me know

Thanks in advance.

[Kanwaljeet Singh · Accepted solution]

Hi,

What error are you getting when trying to import certificate on the ACE? If there is a problem with the certificate itself, it is better to get it regenerated from the CA itself.

Regards,

Kanwal

Note: Please mark answers if they are helpful.

[Ji-Won Park]

Yes, I am trying to re-generate the certificate and try to import it again. However, I was just concerned about the other possibilities that could cause the issue.

I am getting the following error message:

Keypair in mykey.pem does not match certificate in abc.pem

[Kanwaljeet Singh]

Hi,

This clearly indicates a mismatch. Best would be to get the cert from the CA again. May be generate the CSR again and get a new cert.

Regards,

Kanwal

Note: Please mark answers if they are helpful.

[Ji-Won Park]

I had to generate the key-pair again and use that for CSR. Once it was signed, the cert was good to go. 

How do I sync this with the secondary unit?

[Kanwaljeet Singh]

Hi,

You cannot. You have to manually import those files like you did in ACTIVE unit. All configuration changes except probe scripts, crypto files and license are synced automatically to standby_hot unit.

Regards,

Kanwal

Note: Please mark answers if they are helpful.

[Ji-Won Park]

Thanks for the response Fnu,

Could you quickly check if this documentation is correct?

In a redundant configuration, the ACE does not synchronize the SSL certificates and key pairs that are present in the active context with the standby context of a Fault Tolerant (FT) group. If the ACE performs a configuration synchronization and does not find the necessary certificates and keys on the standby, configuration synchronization fails and the standby context enters the STANDBY_COLD state.

To copy the certificates and keys to the standby context, you can export the certificates and keys from the active context to an FTP or TFTP server using thecrypto export command, and then import the certificates and keys to the standby context using the crypto import command. You can also import the certificates and keys directly to the standby context using the same method that you used to import the certificates to the active context. This second method is required if the certificates and keys were imported to the active context as non-exportable. For more information about importing and exporting certificates and keys, see the "Importing or Exporting Certificate and Key Pair Files" section.

To return the standby context to the STANDBY_HOT state in this case, you must import the necessary SSL certificates and keys to the standby context, and then perform a bulk synchronization of the active context configuration by entering the following commands in configuration mode in the active context of the FT group:

1. no ft auto-sync running-config

2. ft auto-sync running-config

[Bilal Nawaz · Accepted solution]

Documentation is correct, like it is stated and as F.K.S mentioned, please import the same cert in to secondary manually (the exact same process used for active) and then sync.

[Ji-Won Park]

Thanks for the help everyone