Cisco ASA Public CA certificate issue with anyconnect client

[JonMoss92624]

Hi all, got an issue that i'm struggling to get to grips with.  I installed a wildcard certificate onto our ASA 5525X firewalls and this certificate is being used for both SSL and IPsec IKEv2 

My problem is it works fine if i browse to the ASA (clientless), but it throws the untrusted server blocked warning when using the anyconnect 4.9.01095 client

This is a new build environment

I appreciate more info will be needed from myself in order to get started t-shooting this, but i'm putting this up as a starter for ten.  Any thoughts / feedback welcome

thanks

Jon

[Rob Ingram]

Hi @JonMoss92624 

Do you have the correct trustpoint enabled for both SSL and IPSec, example:

ssl trust-point PKI_TP OUTSIDE
crypto ikev2 remote-access trustpoint PKI_TP

HTH

[JonMoss92624]

Hi Rob, thanks for the reply, yes they are both set as the same trustpoint, for SSL the trustpoint is also on inside and DMZ as well as the outside interface

[Rob Ingram]

Can you enable debugs on the ASA, an provide the output for review.

You could also install wireshark on a laptop and run whilst connecting to the VPN, provide the pcap for review.

[JonMoss92624]

attachments as requested Rob 

[Rob Ingram · Accepted solution]

I can see your connection to an IPSec VPN and a TLS handshake to the public IP address of the ASA - I can see 1 DNS query/response, querying the IP address NOT the fqdn of the ASA.

What domain name are you connecting to when it works? Can you double check you are connecting using the FQDN (check the anyconnect XML profile). If you connect using the IP address, it will error.

[JonMoss92624 · Accepted solution]

Sincere apologies, I wasn't seeing the wood for the trees..

thank you very much

Jon