When you first go through the web portal and install anyconnect did it download the correct client profile xml?  If it hasn't done this this then obviously the client won't be configured correctly in future.This is the section from our xml, where we ...

I've just got off the phone with Cisco and a very helpful guy called Herbet Baerten who assisted me in a work around for this as you've all identified it is a problem with the latest anyconnect using stricter checking and requiring a key usage field ...