Showing results for 
Search instead for 
Did you mean: 

AnyConnect Certificate Based Authentication.


The information in this document is based on these software and hardware versions:


    ASA 5510 that runs software version 8.2(2) and ASDM version 6.4(9)


    Anyconnect client  software version 3.0 (It will work the same for versions prior to 8.3)



    Microsoft Windows 2003 server as the CA server for the scenario.



Since the ASA version in use is 8.2.x we can enable per tunnel-group certificate authentication.


(Feature in the ASA 8.2.x release, using pre-8.2.x ASA code it will require to globally enabling the certificate authentication with the command

  "ssl certificate-authentication interface <interface> port <portnum>").




In order to acomplish the AnyConnect authentication using certificates the AnyConnect client should get a valid certificate from the CA server, at the

same time the ASA should have the CA Root certificate in order to properly validate the certificate of the connecting client.








1-) Make sure you have an AnyConnect image applied in the ASA firewall:


Configuration > Remote Access VPN > Network (Client) Access > AnyConnect Client Software



Click the Add button, and browse the flash for the proper image (optionally you can upload the client from the local PC).






2-) Enable anyconnect in the outside interface:


Configuration > Remote Access VPN > Network (Client) Access > AnyConnect Connection Profiles


Check the box "Enable Cisco AnyConnect VPN Client or legacy SSL Client"


Then select the interface where the AnyConnect clients will be connecting to (in this example the outside interface).







The " Allow user to select connection profile" check option will allow the AnyConnect user to select the group they will be connecting to.




3-) Create a new AnyConnect connection profile:


Configuration > Remote Access VPN > Network (Client) Access > AnyConnect Connection Profiles



Click the Add button, the "AnyConnect connection profile" window will open.


Give the connection profile a name and optionally a group alias.



Click the "Select" button next to the "Client Address Pools" option.


The " Select Address Pools" window will appear.


Click the "Add" button in order to create a new pool of addresses.








4-) Create a Group-policy:


Configuration > Remote Access VPN > Network (Client) Access > AnyConnect Connection Profiles


Click the "Manage" button  next to the "Group Policy" option in the connection profile.


Click the "Add" button in order to create the new policy.



Give the policy a name (In this example "AnyConnect-Policy") and check the "Clientless SSL VPN" and "SSL VPN Client" boxes, then click the "ok" button.







The AnyConnect group have been created at this point.





5-) Install the CA certificate in the ASA:



The CA certificate must be downloaded from the CA server and installed in the ASA.


Complete these steps in order to download the CA certificate from the CA server.


Perform the web login into the CA server CA-server with the help of the credentials supplied to the VPN server.






Click Download a CA certificate, certificate chain or CRL in order to open the window,

as shown. Click the Base 64 radio button as the encoding method, and click Download CA certificate.






Save the CA certificate with the certnew.cer name on your computer.







Go to Configuration > Remote Access VPN > Certificate Management > CA Certificates in the ASA firewall.


Click on the "Add" button, the "Install Certificate" window will open.


Click the "Browse" button next to the "Install from a file" option.


Browse to the location where you saved the CA certificate, highlight the CA certificate and click on the "Install" button.






At this point the CA certificate will be installed in the ASA fiwall and it willl be able to validate the connecting users, which user's certificate was created from the same CA server.





6-) Go back to the AnyConnect connection profiles and change the profile to use certificate authentication:



Configuration > Remote Access VPN > Network (Client) Access > AnyConnect Connection Profiles


Highlight the "AnyConnect-group" profile and click the "Edit" button.



The "Edit AnyConnect Connection Profile" will open, then you will be able to select the authentication method to be "Certificate"







Click the "OK" button and then click "Apply"


(Remember to save the configuration performed)








7-) The next step would be to install the certificate in the AnyConnect client PC:



The user will need to log in into the CA server with his credentials.







Once in the CA server, the user will need to click in the "Request a certificate" option.





The user will want to select the "User Certificate" option.








At this point the CA sever will provide the user certificate to be installed.







Once the certificate is installed the user will be able to connect the AnyConnect client authenticating with the previously installed certificate

(No username and password required)






Below you will find how the configuration should look like in the CLI interface:





ip local pool AnyConnect mask


      group-policy AnyConect-policy internal

      group-policy AnyConect-policy attributes

        vpn-tunnel-protocol svc webvpn



      tunnel-group AnyConnect-group type remote-access

      tunnel-group AnyConnect-group general-attributes

        address-pool AnyConnect

        default-group-policy AnyConect-policy

      tunnel-group AnyConnect-group webvpn-attributes

        authentication certificate

        group-alias AnyConnect enable





          enable outside

          svc image disk0:/anyconnect-dart-win-2.5.6005-k9.pkg 1

          svc enable

          tunnel-group-list enable





crypto ca trustpoint ASDM_TrustPoint0

        revocation-check none

        no id-usage

        enrollment terminal


      crypto ca authenticate ASDM_TrustPoint0































I hope this information can be helpful for you..


Why does the ASA not require an identity certificate?


This is a good write up but I have a question.  From a security point of view, what methods are there to prevent a user from exporting the client certificate and importing it on multiple devices?

Without 2fa (i.e username and password) the client certificate just comes up as unknown for the user and if it is a device that has not been revoked just loading the certificate device to device will allow rooted or other potential devices to get in or even ex employees.  Outside the cert expiration date if you do not have a 2fa a generic device (like a shared Ipad) could be an easy conduit to a savvy person for backdoor access.  Its nice convenience but seems to me it has its flaws without a 2fa on top of it. 

So from a best practices standpoint would you ever implement just cert authentication for public vpn without a 2fa on top, as certificates can be forgotten or not revoked where typically a user account is termed when someone is let go. 


Exactly Can you have the FW do Certificate authentication and 2fa?  We want to use the Certificate authentication to limit what computers people connect with can it be used for that?

Marvin are you still with us?



Hello y.lo

For certificate authentication the ASA only needs to know the issuer of the client certificate as one of his Trustpoints. For SSL connection the client will check the identity certificate of the ASA installed on the outside interface but that could be issued from a different CA like the ones you request from public entities DigiCert, Symantec, etc.



You could, when installing the certificate, mark it as not exportable, but that can be bypassed with some fancy tools.  But you could, use DAP on the ASA to pull certain attributes from the end point for another 'check'.  Like maybe a certain OS type, a special file residing on the device, etc.  

The end user would not be able to tell what you are checking for.



Is it required to generate certificate in SSL VPN anyconnect configuration.


Hello Marvin,


Great Post !

Would you please advise how you configure the anyconnect client to make it select the correct conn-Profile transparently from the end-user.

Since let's say there are many connection-profiles configured on the ASA.

In your last snapshot i see you are only connecting to the without specifying a url or alias.


Thank you in advance.




When you are migrating certs for SSL-clients and need clients to be able to connect with old cert and new certs to the same ASA on the same interface, is this something that is supported and if so how do you allow both certs to work on the same interface? I know how to do it for Site to Site VPN but not SSL client VPN. 


Hi Steven,


you could make something called certificate to connenction profile mapping, it is like if /then condition.

for example you could say if the user certificate issuer CN= company.CA  then assign connection profile X to this user connecting.

If you have many machine certs on ur connecting PC you could do the certificate mapping in the client XML Profile.

I hope this was your question.

Please rate if helpful



The devices that I have connecting are not users, but yet printers, so they will not have the option to choose a connection profile in the drop down on anyconnect. So is this still possible with that scenario? If so do you have  some documentation you can provide a link for?