ASA - WebVPN - Authentication with client certificate

[cscherb]

Has anyone managed to authenticate with certificates to ASA for WebVPN ?

I configured

tunnel-group DefaultWEBVPNGroup webvpn-attributes

authentication certificate

but still getting the error message

Group <DefaultWEBVPNgroup> User <...> IP <...> Authentication:rejected, Session Type: WebVPN

[j-block]

Following links may help you

http://www.cisco.com/en/US/docs/security/asa/asa71/configuration/guide/webvpn.html

http://www.cisco.com/en/US/products/ps6120/products_installation_and_configuration_guide_chapter09186a008069066f.html

[cscherb]

I was able to use digital certificates with WebVPN using the folowing configuration:

tunnel-group DefaultWEBVPNGroup general-attributes

authorization-server-group LOCAL

authorization-required

authorization-dn-attributes CN

tunnel-group DefaultWEBVPNGroup webvpn-attributes

authentication certificate

In addition to this configuration I had to add alle CN values of certificates which are allowed to establish a WebVPN session to the local database.