MD5 signed Certificates not able to connect to ASA 9.8(2)28 !

[bern81]

Hello,

We have machine certificates with MD5RSA signature Algorithm and SignatueHashAlogrithm MD5, with public key (RSA) 1024 bits on our employees PCs.

Those machines are able to connect RA anyconnect SSL VPN to our ASA 9.1(7)16 using AAA+Certificate authentication method.

The certificate has an Extended Key Usage= Client Authentication.

However when trying to connect to our new ASA 9.8(2)28, we get "certificate validation failure" message in anyconnect.

After running debug, we see the following message:

"No certificates received during the handshake with client Public:w.x.y.z/52494 to w.x.y.z/443 for DTLSv1 session".

We have enabled "certificate store override" in the xml profile but still same issue!

Can someone advise if MD5 signed certificates are still allowed on ASA9.8 or not?

Many thanks in advance

[venkat_n7]

Hi,

as i know md5 is no more a secured hashing and not recommended. it looks like you have to use SHA.  

hope this should help you.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa98/configuration/vpn/asa-98-vpn-config/vpn-params.html#ID-2443-000004b5

[Dennis Mink]

I advise you to steer away from MD5 all together. is usefull for integrity checks but not in a security context.

[bern81]

Hello Dennis and Venkrat,

Many thanks for your reply,

I know that MD5 is not anymore a secure Hashing, but i have the ugly fact that now all employees Laptops (Thousands) have this MD5 signed certificates and i am trying to find a temporary workaround until we roll-out new certificate that are SHA256 signed.

The question that i would like to know if MD5 signed certificates are still supported on new versions like ASA 9.8 or not.

Venkrat sent me the list of SSL Ciphers supported in 9.8.

What i am trying to figure out if the SSL cipher suites are related to the signature algorithm of the digital certificate or just related to what the client's PC can support?

Please advise