Installing certificate for SSL vpn in ASA 5510

[Shibu1978]

Dear All,

We have purchased "True BusinessID certificate" from Geotrust for our SSL VPN.  Geotrust issued 2 certificates such as Web Server CERTIFICATE & INTERMEDIATE CA.

SSL vpn is being configured in Cisco ASA 5510 software version 7.2(3). Now we could successfully install INTERMEDIATE CA successfully to ASA but Web Server CERTIFICATE cannot install and gives the following error

*Failed to parse or verify imported certificate*

We followed this link to install the certificates

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00808a61cd.shtml

We contacted geotrust regarding this errror and they suggest to install GeoTrust Root along with the Primary & Secondary Intermediate CA certificates for True BusinessID certificate.

https://knowledge.geotrust.com/support/knowledge-base/index?page=content&id=SO19785&actp=AGENT_REFERAL

1. Can anyone please help us to install Root along with the Primary & Secondary Intermediate CA certificates on our Cisco ASA 5510 version 7.2(3)  . is there any proper way to install certificate i mean ROOT--intermediate--identify ?

2. Have we seleted the exact SSL certificate from Geotrust for our SSL VPN? is there any other certificate we should get it from Geotrust? please shed some light on this.

Thanks in advance

[Shibu1978]

Dear All,

Can anyone please respond?

[Shibu1978]

Can anyone kindly response to this?

[craig bache · Accepted solution]

Hi,

Please see the following from the Cisco site,

This error can occur when you install the identity certificate and do not have the correct intermediate or root CA certificate authenticated with the associated trustpoint. You must remove and reauthenticate with the correct intermediate or root CA certificate. Contact your 3rd party vendor in order to verify that you received the correct CA certificate.

Could you check the following:

show crypto ca trustpoint

show crypto ca certificate

show crypto ca crls

show crypto key mypubkey rsa

Regrads Craig

[Shibu1978]

Thanks for your response.

Kindly find below the command out put for your kind persual.

ASA-5510-1# sh crypto ca trustpoints

Trustpoint my.geotrust.trustpoint:
    Subject Name:
    cn=GeoTrust Global CA
    o=GeoTrust Inc.
    c=US
          Serial Number: 12bbe6
    Certificate configured.

====================================

ASA-5510-1#
ASA-5510-1# show crypto ca certificate
CA Certificate
  Status: Available
  Certificate Serial Number: 12bbe6
  Certificate Usage: General Purpose
  Public Key Type: RSA (2048 bits)
  Issuer Name:
    ou=Equifax Secure Certificate Authority
    o=Equifax
    c=US
  Subject Name:
    cn=GeoTrust Global CA
    o=GeoTrust Inc.
    c=US
  CRL Distribution Points:
    [1]  http://crl.geotrust.com/crls/secureca.crl
  Validity Date:
    start date: 08:00:00 UAE May 21 2002
    end   date: 08:00:00 UAE Aug 21 2018
  Associated Trustpoints: my.geotrust.trustpoint

============================================

ASA-5510-1# show crypto ca crls
No CRLs are currently cached.

=============================================================
ASA-5510-1# show crypto key mypubkey rsa
Key pair was generated at: 06:52:10 UAE May 3 2010
Key name:
Usage: General Purpose Key
Modulus Size (bits): 1024
Key Data:

  30819f30 0d06092a 864886f7 0d010101 05000381 8d003081 89028181 00dfc4d5
  b7cf8e24 c2760aa9 37a5d40f 179903d2 b3d51357 5b219bee 3270fb1c 48cd16e1
  9004d5c6 ec86bdb7 ebc71e8c 455d05eb 312db6f5 aef97aef 8bf23427 04ca4959
  803cc460 852f49cc 776f6d98 57baec74 5ad1acbc 3cc279ac 52de5869 3dab1f37
  3c62f475 6ba808eb 0e4e0499 71a8f31d cf72f72f 69b5bff9 ca33c032 19020301 0001
Key pair was generated at: 17:36:40 UAE Apr 19 2012
Key name: my.geotrust.key
Usage: General Purpose Key
Modulus Size (bits): 2048
Key Data:

  30820122 300d0609 2a864886 f70d0101 01050003 82010f00 3082010a 02820101
  008e8e84 b1adf90f d52d1d89 040b3ce7 3fe07c9c 3cb53ee0 9d71957d b26697f4
  7df72cc3 76413697 cc25014b ee45ad2b 07734549 58e489e6 d826e853 784e6e23
  abcbdade 6cdd674c 6160a9f5 d01a80ec 67c9677b 3aa38361 7e7862d0 34ce1e77
  759b6f32 4069fe95 bb3f40b0 3c9670b5 3401d70e 4d6b43d6 42caa2fa c1d2cf91
  ad8bb4e6 8b6b1cfa 6be5b061 efbb6b30 6ac1e240 ec5241e0 22a5a8b8 27fcce01
  2939037d e993cca1 21fa4e02 380820a1 079273bb 43d9ebb4 a03908d9 d43426b1
  e6fd3c75 40c95cd2 d52f176d 5006cc1b 588609ec f2135451 b6101a3d f4f24ec7
  6160f75a 82738b99 c7499675 cf0a4183 c6a4fc49 75fc9709 87f94427 04ceb4ef
  6d020301 0001
Key pair was generated at: 23:23:42 UAE Apr 22 2012
Key name: .server
Usage: Encryption Key
Modulus Size (bits): 768
Key Data:

  307c300d 06092a86 4886f70d 01010105 00036b00 30680261 00aaca61 b80c8cf2
  01b74427 4ec8e7a6 50774d04 3506aa46 87d5740b bd842a34 25789e1e f544c14b
  76c1f651 a9f3a44e f6dc5747 851895c1 633e944d 538c55bd f72f4181 3632688b
  25407ea6 01a12c59 67b89bf1 befcd92f 4ba98fa3 16b6070b 35020301 0001
ASA-5510-1#

Debugg while importing identity certificate
=====================================
ERROR: Failed to parse or verify imported certificate

ASA-5510-1(config)#
CRYPTO_PKI: status = 1795: failed to verify or insert the cert into storage

[Shibu1978]

Can anyone please respond

[Marvin Rhoads]

The Geotrust article in your original post is pretty explicit about how to install the necessary certificates. Just follow that procedure.

[Shibu1978]

Hi All,

The issue i was getting the error while importing certificate to ASA 5510 7.2(3) was due to identifty certificate issued from CA. there were some fields were empty on the subject tab inside the certificate.

To isolate the issue we had to revoke the old certificate and generate a new one. 

In Geotrust there is no such procedure to install certificte in ASA 5510 software version 7.2(3)  .. they have procedure for 8.0 which is tottaly different fron 7.2

Thanks to all your response.