Export Identity cert from FirePower to ASA

[Najib Akbari]

Hi,

I use ASDM and export Identity cert + PKey from Firepower 2310 ( ASA mode ) and when I import it to ASA 5512 it gives error:

FP ASA version : 9.18(4)22

ASA 5512 version: 9.12(4)37 

[Rob Ingram]

@Najib Akbari if the export was completed successfully, perhaps there is a discrepancy between the newer and older ASA versions that prevents it being imported successfully.

Import the file from the CLI on the 5512 using the command "crypto ca import <trustpoint> pkcs12 <passphrase> " - if that fails enable crypto debugging, try again and provide the debug output. If the error on the CLI is more descriptive than the ASDM GUI, provide that error too.

[Najib Akbari]

I did and failed again and here is the log i see with"debug crypto ca transactions" and "debug crypto ca mess 255":

CRYPTO_PKI: certificate contains 10 extensions.
CRYPTO_PKI: certificate contains extension OID:
2b 06 01 04 01 82 37 15 01
CRYPTO_PKI: certificate contains extension OID:
2b 06 01 04 01 82 37 15 02
CRYPTO_PKI: certificate contains extension OID:
55 1d 0e
CRYPTO_PKI: certificate contains extension OID:
55 1d 20
CRYPTO_PKI: certificate contains extension OID:
2b 06 01 04 01 82 37 14 02
CRYPTO_PKI: certificate contains extension OID:
55 1d 0f
CRYPTO_PKI: certificate contains extension OID:
55 1d 13
CRYPTO_PKI: certificate contains extension OID:
55 1d 23
CRYPTO_PKI: certificate contains extension OID:
55 1d 1f
CRYPTO_PKI: certificate contains extension OID:

[ahollifield]

Why do you want to do this?  Why not just re-issue/re-key the certificate?  Also why ASA and not FTD?

[Najib Akbari]

the cert is already active on 2X FP ASA and if I re-issue then I have to do it on all devices. also for the second part if you mean why not using FirePower as FTD then the answer is this is an old ASA 5500 and not firepower and I use it for LAB.

we have Firepowers we particularly using as ASA VPN anyconnect and I am not familiar with FTD if that mode is also can support VPN and be as reliable as ASA mode .....