4.0(2d)C ... View more

A decommission\recommission will fix it for some time.. However, it still comes back for us.   Yes, we have opened a TAC case..  they just tell us to decommission\recommission.   -Archie   ... View more

I am seeing the same errors with version 4.0(2a)  Any plans to address this in 4.x?   -Archie ... View more

Not really any help. ... View more

1.  ClientCertificateThumbprint stanza is there but empty. 2. Signature Algorthim is sha512RSA.  Not sure of the version 3. Most are windows users, not Mac. ... View more

<?xml version="1.0" encoding="UTF-8"?> <AnyConnectProfile xmlns="http://schemas.xmlsoap.org/encoding/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://schemas.xmlsoap.org/encoding/ AnyConnectProfile.xsd"> <ClientInitialization> <UseStartBeforeLogon UserControllable="false">false</UseStartBeforeLogon> <AutomaticCertSelection UserControllable="false">true</AutomaticCertSelection> <ShowPreConnectMessage>false</ShowPreConnectMessage> <CertificateStore>All</CertificateStore> <CertificateStoreOverride>true</CertificateStoreOverride> <ProxySettings>Native</ProxySettings> <AllowLocalProxyConnections>false</AllowLocalProxyConnections> <AuthenticationTimeout>20</AuthenticationTimeout> <AutoConnectOnStart UserControllable="false">false</AutoConnectOnStart> <MinimizeOnConnect UserControllable="false">true</MinimizeOnConnect> <LocalLanAccess UserControllable="false">false</LocalLanAccess> <DisableCaptivePortalDetection UserControllable="true">false</DisableCaptivePortalDetection> <ClearSmartcardPin UserControllable="false">true</ClearSmartcardPin> <IPProtocolSupport>IPv4,IPv6</IPProtocolSupport> <AutoReconnect UserControllable="true">true <AutoReconnectBehavior UserControllable="false">DisconnectOnSuspend</AutoReconnectBehavior> </AutoReconnect> <AutoUpdate UserControllable="false">true</AutoUpdate> <RSASecurIDIntegration UserControllable="false">Automatic</RSASecurIDIntegration> <WindowsLogonEnforcement>SingleLocalLogon</WindowsLogonEnforcement> <WindowsVPNEstablishment>LocalUsersOnly</WindowsVPNEstablishment> <AutomaticVPNPolicy>false</AutomaticVPNPolicy> <PPPExclusion UserControllable="false">Disable <PPPExclusionServerIP UserControllable="false"></PPPExclusionServerIP> </PPPExclusion> <EnableScripting UserControllable="false">false</EnableScripting> <EnableAutomaticServerSelection UserControllable="false">false <AutoServerSelectionImprovement>20</AutoServerSelectionImprovement> <AutoServerSelectionSuspendTime>4</AutoServerSelectionSuspendTime> </EnableAutomaticServerSelection> <RetainVpnOnLogoff>true <UserEnforcement>SameUserOnly</UserEnforcement> </RetainVpnOnLogoff> <AllowManualHostInput>true</AllowManualHostInput> </ClientInitialization> removed all ServerList stanzas </AnyConnectProfile> ... View more

EKU: Secure Email (1.3.6.1.5.5.7.3.4) Client Authentication (1.3.6.1.5.5.7.3.2) KU: Digital Signature, Non-Repudiation (c0) Let me clean up the profiles/*.xml and I will attach them. ... View more

Okay.. I got past that by the following... ~/.cisco/certificates (the issuer cert in subdirectory /ca, the client cert in /client, the private key in /client/private). CA cert and client cert need to have .pem extention, private key needs to have same filename as client cert but with .key instead of .pem. Same filename and .key was my issue. I see in the logs now where anyconnect finds my user cert  and CA.. but I am still getting the below error.  Feb 1 10:48:14 Cisco AnyConnect Secure Mobility Client[8789]: Function: processIfcData File: ../../vpn/Api/ConnectMgr.cpp Line: 3274 Certificate authentication requested from gateway, no valid certs found in users cert store. Feb 1 10:48:14 Cisco AnyConnect Secure Mobility Client[8789]: Message type warning sent to the user: No valid certificates available for authentication. ... View more

I see.. Bag Attributes     localKeyID: 01 00 00 00     Microsoft CSP Name: Microsoft Enhanced Cryptographic Provider v1.0     friendlyName: le-DefaultUserCertificate-e7e8b26a-1cb6-4a5f-8cc6-ad90ccd42249 Key Attributes     X509v3 Key Usage: 80 -----BEGIN RSA PRIVATE KEY----- MIIEpAIBAAKCAQEApHvZ62rqaH2HA9ynZo4gzRHKBRFDsY6OchSuNtvLWQBFmtWC ... ... -----END RSA PRIVATE KEY----- Do I need to remove the lines above the ----- BEGIN ? ... View more

Okay, here is what I attempted.. I exported my user cert with private key to all.pfx from my Windows 7 machine and copied the file over to Mac. On Mac: # openssl pkcs12 -in all.pfx -nocerts -out ~/.cisco/certificate/client/private/private.pem -nodes # openssl pkcs12 -in all.pfx -nokeys -out ~/.cisco/certificate/client/ cert.pem -nodes I see the following Anyconnect error when I attempt to connect. Feb  1 09:29:14 Cisco AnyConnect Secure Mobility Client[7389]: Function: enumerateCert File: ../../vpn/CommonCrypt/Certificates/FileCertStore.cpp Line: 193 Invoked Function: _tstat Return Code: 2 (0x00000002) Description: unknown missing private key for client cert file: /Users/archspangler/.cisco/certificates/client/cert.pem Seems like something simple but I cannot figure it out. ... View more

Is there a procedure for putting the CA and User certs in the ~/.cisco/certificates/ca and ~/.cisco/certificates/client directories?   I was thinking about trying that because it appears that Anyconnect cannot see the certs in the keychain (according to the system.log). When I run "certtool y"  I can see my company CA and my user certs. ... View more