Export/Import certificates from ASA to FTD

[Chess Norris]

Hi,

I'm migrating a multi-context ASA with both identity and CA certificates to a FTD and I wonder what would be the best way to export those certificates from the ASA and then import them to a FTD? I have access to both CLI and ASDM on the ASA, but would prefere using the CLI. In ASDM there is an option to export identity certificates, but not the CA certificates so I guess I need to use a different methods for those?

Thanks

/Chess 

[Rob Ingram]

@Chess Norris here is a guide to export the ASA certificate to PKCS12 file. On the FTD you just need to import the PKCS12 file.

[Chess Norris]

Thanks for the quick reply. I'll take a look at this guide.

/Chess

[Chess Norris]

@Rob Ingram While I was able to export/import some of the certificates, the one that are currently associated with RA VPN on the ASA fails. When I'm trying to enroll it on FTD, it gives me an error saying "Fail to configure CA certificate"

Using the exact same method I was able to enroll some other identity certificates, so I am not sure why this one fails. How can I troubleshoot this?

Thanks

/Chess

[Chess Norris]

Followed every step in this troubleshoot guide - Troubleshoot Certificate Error "Fail to configure CA certificate" on FMC , but without any luck. I'm still getting the same error when trying to enroll. It's so strange because the same cert works perfectly on the ASA. 

/Chess

[Rob Ingram]

@Chess Norris what is the difference between the certificate(s) that worked and the one that doesn't? Perhaps a key size not supported on FTD/FMC?

[Chess Norris · Accepted solution]

I was able to solve the issue by following this guide AnyConnect (FTD), PKCS12, and OpenSSL 

I used OpenSSL to associate the CA chain and created a new PKCS12 file. After doing that, I could enroll the certificate in FMC without any issues.

/Chess