Unable to connect via ASDM after upgrading ASDM image in ASA to 7202

[debbiebeitler]

Tried to upgrade ASDM on a 9.16 ASAv, from 7181-152 to 7202.
Worked fine on the "secondary" asa.
But on the active one, Cannot connect after restarting ASDM.
I goes through the entire log in process, and then I get "ASDM cannot be loaded, hostname wrong".

I can still SSH into it, and everything look goods, so I did a reload. And now I get "The certificate present in this device is not valid. Certificate date is Expired...."
The Date on the ASA is fine.
It has the same certificates and CA certs as did the backup. None of which show as expired.

I reverted back to the previous ASDM image for now.

[pieterh]

>>> Tried to upgrade ASDM on a 9.16 ASAv, from 7181-152 to 7202.
Worked fine on the "secondary" asa. <<<
this is not possible!
you need to set your ASDM version from the primary (c.q. active) ASA
it will activate this for BOTH failover members at the same time (as this is replicated)

my workflow is for the GUI (old ASDM version)
- transfer the ASDM image to the standby ASA
- answer NO  to the question for setting this as the default ASDM image
- transfer the ASDM image to the active ASA
- answer YES to the  question for setting this as the default ASDM image
- restart ASDM connection to use the new version

[debbiebeitler]

This is an ASA virtual.  So the config is not shared or replicated between them. basically they are two separate devices with what amounts to a load balancer between them.

[debbiebeitler]

Same result with asdm-7201.  Using asdm-7191-95 works fine.

[debbiebeitler]

Upgrading the ASA tp 9.18.3.56 does not make a difference.  Still works with asdm-7191. but not with either asdm 7201 or 7272

[pieterh]

back to the first post
>>> And now I get "The certificate present in this device is not valid. Certificate date is Expired...." <<<
and your addition >>> basically they are two separate devices with what amounts to a load balancer between them <<<
did you check the consistency of certificates between the two ASA's (maybe also the load-balancer) ?
(IS the expected certificate assigned to the management interface ?)

[debbiebeitler · Accepted solution]

On both units, there are no certificates assigned to the management interface. Only to the public and internal. 

However, I accessed the management interface with a browser and saw that it using an older VPN cert "ssl trust-point <expired cert>" management.  Odd thing is that in the ASDM, it did not show a cert attached to the management interface.  The other one that worked fine, was using the self-signed ASA certificate.  I removed the line "ssl trust-point" line for the management interface and it went back to using the self-signed cert which has not expired.  So ASDM is now happy with version 7202.

Thanks for helping the light bulb go off.

[pieterh]

I'm happy to hear you found the interfering configuration
Regards,

Pieter

[Ced W]

Hello,
I am having the same problem. I only have 1 ASA5525 running ASA Version 9.14(4)24 and ASDM version 7.18(1)152. ASA upgrade went fine. but when I tried to upgrade the ASDM, I received the error "The certificate present in this device is not valid. Certificate date is Expired or not valid as per current date". 

How do I roll back the ASDM version if I do not have access to the ASA through the ASDM ...? Thank you ...!

[tomasz.gluszko]

Just add in Java security tab https://ip_address_asa - then ASDM 7202 will work as well