CA certificate installation problem

[DAVIES604]

Hi all,

I'm having problems installing a CA cert on the ASA. The root cert installs fine, but the intermediate will not. Is there a character length limit for the CRL within the cert?

Debugging we get this output,

CERT-C: E ../cert-c/source/certobj.c(1516) : Error #705h

CERT-C: E ../cert-c/source/certobj.c(1528) : Error #72ah

CERT-C: E ../cert-c/source/certobj.c(874) : Error #72ah

CRYPTO_PKI: can not set ca cert object (0x72a)
CRYPTO_PKI: status = 65535: failed to process RA certificate

Any help appreciated.

[Rahul Govindan]

Are you trying to add it into the same trustpoint as the Root? This won't be possible as a trustpoint can only hold 1 CA cert (Root or intermediate) . Try adding this to another trustpoint if you have not done that already.

Also, which CA is this? Can you paste the steps that you took to install the intermediate cert?

[DAVIES604]

Hi, many thanks for your reply.
After some trial and error fault finding, we discovered it was the Naming Constraints extension in the cert that the ASA didn’t like, we’re not sure exactly what it doesn’t like, but with them removed it installs fine.