ASA 5515

[IamDaMayor]

Good Day

Is it possible to apply an internal CA certificate to an ASA internal interface and SSL VPN feature?

If so how does one go about doing so?

[Francesco Molino]

Hi

Can you give more details on what you're trying to achieve?

Is it having ASA acting as CA server or looking ASA with a corporate CA?

And then leverage vpn authentication with certificates?

[IamDaMayor]

When users browses to the management / internal facing IP of the ASA (to access the ASDM) the attached message appears.

How does user apply a certificate to prevent this invalid message appearing ? Users does not want the ASA to be a CA, but would like the ASA to have a Corporate CA cert attached to it. But there are no certificates needed for VPNs at this time

[Francesco Molino]

OK got it.

You can create a certificate for ASA. Follow that Cisco doc: https://www.cisco.com/c/en/us/support/docs/security-vpn/public-key-infrastructure-pki/200339-Configure-ASA-SSL-Digital-Certificate-I.html

If you generate a certificate with an internal CA, users must have the chain (root and subordinate) to trust that certificate. 

You can also get a public certificate to not get this message for any users...

[IamDaMayor]

User has already tried using that link but as per user it was not helpful

User would like to apply an internal cert to the management interface (used on the internal network).

[Francesco Molino]

I'm sorry but I don't understand your issue here.

The link is talking about importing a certificate on ASA (no matter if that's a public or internal CA).

The goal is to :

- create a trustpoint

- authenticate that trustpoint by importing your Root CA

- Use openssl to generate your ASA cert

- import the cert into ASA.

Steps are the same for internal certificate or external certificate