Heads Up :
The post you are writing will appear in a public forum. Please ensure all content is appropriate for public consumption. Review the employee guidelines for the community here.
Hi,
I am trying to LAB my way trough how Certificate based VPN is working.
I have one "offline" root CA (Trust Anchor) and one "online" Issuing CA/SubCAMy AnyConnect client authenticates perfect with certificate based VPN If I revoke the client cert...
Hi,My SIP provider sends all incoming national calling numbers with a plus sign +45 (E164 / denmark).The UC500 can not handle this, have do I search and strip the + and country code?regardsHenrik Meyerwww.networker.dk
I have cleared up in the Certificates on the ASA.
The ASA is not holding the Private Key for the local Issuing CA - it is only the public key for the local Issuing CA.
Now there is only the Public ASA cert vpn.domain.com and the local Issuing CA. c...
ASDM_TrustPoint2 the public certificate is not used in the validation of the AnyConnect VPN Client Machine certificate. (I have never statet this either) It is used, so the AnyConnect Client is not getting an "SSL error" due to a self-sign local ASA ...
ASDM_TrustPoint0 = Internal Issuing CA/Sub CA (Server: "rootCA" is the "Offline Root CA" that issued the certificate for the Internal "Issuing CA" named CA01.int.domain.com)
My Internal PKI infrastructure:
"Offline Root CA" -> "Issuing CA" -> "Clien...
My original issue/question was also related to CRL check of the "Issuing CA" CDP. (The CRL from the "offline" Root CA)
So that all certificates issued from a revoked Issuing CA, would not get validated.
In my example, I do not even need the ASA Device cert issued from the Internal Issuing CA.
The VPN clients certificates are validated against the "Issuing CA Trust Point"