We thought this was going to be a relatively easy fix to get Secure LDAP up again after ASA upgrade.
Recently upgraded an ASA5525 to 9.14.2 and AnyConnect authentication was impacted by cert requirement according the 9.13 release notes we need a cert from the Windows Server 2012 domain controller. First, I was provided a wildcard cert from the server and the serial numbers did not match. Then, I was provided a chained cert (two certs) from the server in .cer format. I tried importing them but got errors below at bottom.
Questions:
(1) Does the ASA support a chained cert (two cert files) from Windows Server 2012?
(2) What format cert files should be provided?
(3) Do the certs need private key, public keys, or general keys?
f(config)# crypto ca import SECURE_LDAP certificate
WARNING: The certificate enrollment is configured with an fqdn
that differs from the system fqdn. If this certificate will be
used for VPN authentication this may cause connection problems.
Would you like to continue with this enrollment? [yes/no]: y
% The fully-qualified domain name in the certificate will be: <edit>
Enter the base 64 encoded certificate.
End with the word "quit" on a line by itself
-----BEGIN CERTIFICATE-----
<edit>
-----END CERTIFICATE-----
quit
Cannot import certificate -
Certificate does not contain device's Signature public key
for trust point SECURE_LDAP
ERROR: Failed to parse or verify imported certificate
f(config)# crypto ca import SECURE_LDAP certificate
WARNING: The certificate enrollment is configured with an fqdn
that differs from the system fqdn. If this certificate will be
used for VPN authentication this may cause connection problems.
Would you like to continue with this enrollment? [yes/no]: y
% The fully-qualified domain name in the certificate will be: <edit>
Enter the base 64 encoded certificate.
End with the word "quit" on a line by itself
-----BEGIN CERTIFICATE-----
<edit>
-----END CERTIFICATE-----
quit
Cannot import certificate -
Certificate does not contain device's General Purpose public key
for trust point SECURE_LDAP
ERROR: Failed to parse or verify imported certificate
Thanks much to anyone who can help.
