AnyConnect: Got an error after updating macOS Catalina

[BevisChen00743]

I got this error after updating to macOS Catalina. I have tried to install the version 4.6, 4.7, 4.8 but still the same.

"AnyConnect cannot confirm it is connected to your secure gateway.  The local network may not be trustworthy.  Please try another network."

Any ideas are welcome.

[Marius Gunnerud]

Are you using a third party certificate on the ASA? if yes is the CA certificate also installed on the Mac?  

If no, have you installed the ASA self signed certificate in the Mac?

[ARizzo]

This worked for a user I had who had this issue.

Not sure what changed on Mac with this but on Catalina the user installed the self signed from the firewall. They were then able to connect again!

Thanks!

[Marius Gunnerud]

Could you please select the post as the correct answer so we stop monitoring the question if it is solved.

Thank you.

[BevisChen00743]

How to install the self signed from the firewall? 

My workmate talked me all certificates should be installed automatically when you connect to the VPN.

[BevisChen00743]

"Are you using a third party certificate on the ASA? if yes is the CA certificate also installed on the Mac?"

I am not sure. But I have exported the CA certificate from the other Mac and install it on my Mac, unfortunately it still doesn't work.

[ram_euhr]

Hello,

I recently updated to MacOS Catalina (v10.15) and since then I am getting this error (Anyconnect cannot confirm if its connected to your secure gateway...) while connecting via vpn (even tried updating to the latest version of VPN client - v4.8.00175).

We do not have any certificate installed on the ASA. Any thoughts on how do I get this working?

[Erick Guazo]

The problem is that the certificate (either 3rd party signed or self-signed) that is loaded on your ASA was created with an RSA key of size lower than 2048:

ASA# sh run ssl
ssl trust-point AC_cert Outside

ASA# show crypto ca certificates AC_cert
Certificate
  Status: Available
  Certificate Serial Number: xxxx
  Certificate Usage: General Purpose
  Public Key Type: RSA (1024 bits)  <<<<<

Starting on MacOS 10.15 (Catalina), those certificates are no longer trusted by Apple and therefore you will receive the error message on AnyConnect

 https://support.apple.com/en-us/HT210176

TLS server certificates and issuing CAs using RSA keys must use key sizes greater than or equal to 2048 bits. 
Certificates using RSA key sizes smaller than 2048 bits are no longer trusted for TLS.

Do NOT change the AnyConnectLocalPolicy.xml file on the Macbook!
Regenerate your certificate using either an RSA key of at least 2048 bits or using an ECDSA key instead!  

[katony]

Why shouldn't the AnyConnectLocalPolicy.xml file be edited? Was does editing it do? Any type of vulnerability? explanations please.

[ageekinthecity]

upgraded to Catalina and got Cisco Anyconnect version 4.8.00175

All certificates are there. 

Connection error:

Posture Assessment Failed: Unable to download CSD library. Please try again

Any ideas?

[Marius Gunnerud · Accepted solution]

open terminal and do the following (you will need administrator rights on your Mac)

cd /opt/cisco/AnyConnect

sudo nano AnyConnectLocalPolicy.xml

Then edit the field for ExcludeMacNativeCertStore to "true"

<ExcludeMacNativeCertStore>true</ExcludeMacNativeCertStore>

^X  (control X to exit)

press Y to indicate that you want to save

press enter to accept the existing name

Quit AnyConnect and start it up again.  You will now receive a certificate warning with the option to continue and, if available, install the certificate.

[WorldViewDeLuca]

I have tired the suggested change. I get a warning and hit Connect Anyway, and then I go right back to the same error.

Any thoughts on what may still be the problem? This groups is the closest thing I have found. Thanks!

[DM6805]

Same issue.  After updating the XML file, I got the Certificate is from an untrusted source.

I tried Connect Anway (with and without  Always Trust Server... checkbox checked)

I just upgraded from macOS 10.14.x to macOS 10.15.1 in place.

I upgrade my AnyConnect client from 4.6.x to 4.8.00175

VPN had been working fine under Mojave.  

Reading (now) others are having issues in this forum and around the web.

Any suggestions

[dcamp]

When I tick the "Always trust this server and import the certificate" checkbox, the login fails -- if I do NOT check that box, the login succeeds for me.

[cdemont]

Many thanks !!!!