Anyconnect 4.3.05017 "no valid certificates available for authentication" Mac OS 10.12.3

[archspangler]

I am using macOS 10.12.3 and Cisco Anyconnect VPN client version 4.3.05017.   I recently started getting the following error when attempting to connect to my work VPN server  "no valid certificates available for authentication".   My company issuing CA certificate and my User certificate both look fine in Keychain but it appears that the Cisco Anyconnect VPN client validate that I have the proper certificates.  

What logs on the client side would be of interest to investigate?

How can I validate that the Cisco Anyconnet VPN can see and use my user certificate for authentication?

Any help would be most appreciated.

Thanks.

[archspangler]

<?xml version="1.0" encoding="UTF-8"?>
<AnyConnectProfile xmlns="http://schemas.xmlsoap.org/encoding/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://schemas.xmlsoap.org/encoding/ AnyConnectProfile.xsd">
<ClientInitialization>
<UseStartBeforeLogon UserControllable="false">false</UseStartBeforeLogon>
<AutomaticCertSelection UserControllable="false">true</AutomaticCertSelection>
<ShowPreConnectMessage>false</ShowPreConnectMessage>
<CertificateStore>All</CertificateStore>
<CertificateStoreOverride>true</CertificateStoreOverride>
<ProxySettings>Native</ProxySettings>
<AllowLocalProxyConnections>false</AllowLocalProxyConnections>
<AuthenticationTimeout>20</AuthenticationTimeout>
<AutoConnectOnStart UserControllable="false">false</AutoConnectOnStart>
<MinimizeOnConnect UserControllable="false">true</MinimizeOnConnect>
<LocalLanAccess UserControllable="false">false</LocalLanAccess>
<DisableCaptivePortalDetection UserControllable="true">false</DisableCaptivePortalDetection>
<ClearSmartcardPin UserControllable="false">true</ClearSmartcardPin>
<IPProtocolSupport>IPv4,IPv6</IPProtocolSupport>
<AutoReconnect UserControllable="true">true
<AutoReconnectBehavior UserControllable="false">DisconnectOnSuspend</AutoReconnectBehavior>
</AutoReconnect>
<AutoUpdate UserControllable="false">true</AutoUpdate>
<RSASecurIDIntegration UserControllable="false">Automatic</RSASecurIDIntegration>
<WindowsLogonEnforcement>SingleLocalLogon</WindowsLogonEnforcement>
<WindowsVPNEstablishment>LocalUsersOnly</WindowsVPNEstablishment>
<AutomaticVPNPolicy>false</AutomaticVPNPolicy>
<PPPExclusion UserControllable="false">Disable
<PPPExclusionServerIP UserControllable="false"></PPPExclusionServerIP>
</PPPExclusion>
<EnableScripting UserControllable="false">false</EnableScripting>
<EnableAutomaticServerSelection UserControllable="false">false
<AutoServerSelectionImprovement>20</AutoServerSelectionImprovement>
<AutoServerSelectionSuspendTime>4</AutoServerSelectionSuspendTime>
</EnableAutomaticServerSelection>
<RetainVpnOnLogoff>true
<UserEnforcement>SameUserOnly</UserEnforcement>
</RetainVpnOnLogoff>
<AllowManualHostInput>true</AllowManualHostInput>
</ClientInitialization>

removed all ServerList stanzas

</AnyConnectProfile>

[Rahul Govindan]

Your KU and EKU fields look correct. Your profile does not seen to have any custom certificate matching fields.

Few more things:

1) Check /Users/<username>/.anyconnect file. If there is a section for <ClientCertificateThumbprint> filled with a Thumbprint value, try removing this line from that file and testing. (Copy the original just in case).

2) Is your certificate have a SHA2 hash? Also, do you know what version your ASA headend is using?

I am surprised that only you are seeing this issue in your organization. Does everyone else (Windows) have the same Anyconnect version as you?

[archspangler]

1. ClientCertificateThumbprint stanza is there but empty.

2. Signature Algorthim is sha512RSA.  Not sure of the version

3. Most are windows users, not Mac.

[Rahul Govindan]

Thanks for that info. I check the release notes and I believe you are hitting the following bug with the ASA:

ASA 9.5.2 does not send CERT_REQ for 512-bit certificate

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuy30069

I believe the ASA sends a CERT_REQ to client to pick up a certificate certificate, but it does not have the right info to pick up a sha512 certificate. That's why the Anyconnect client does not detect it as a valid certificate as your certs are with SHA512 hash. I believe this should be fixed after an upgrade of the ASA version to a fixed release.

Hope this helps.

[Rahul Govindan]

Another option I was thinking about to validate if this is the bug is to have a cert issued with a Sha256 hash. This way you would be able to determine if the bug CSCuy30069 is a valid match or not.

[archspangler]

One thing I find interesting from the logs is: 

Cisco AnyConnect Secure Mobility Client[27750]: Function: getCertList File: ../../vpn/Api/ApiCert.cpp Line: 339 Number of certificates found: 4

Only 4 found?  Went I look in keychain for login types I see a lot more..  

It's almost like the Cisco Anyconnect VPN is looking at only the Apple Login Certificates signed be the Apple CA.  It's doesn't appear to be looking at my Company CA and Company User Certificates.

[Rahul Govindan]

For client cert authentication, the OS is going to look for certs that have the EKU field set to Client authentication (or no EKU field which means all usages). so even though you have many certs, not all of them are used for purposes of client cert authentication. If you have a client certificate matching criterion in your client side xml profile, it bypasses this requirement and looks for certs based on that criterion.

[Philip D'Ath]

Are you sure one of the certificates has not simply expired?

Has your machine definitely got the correct date and time on it?

[archspangler]

I can see in my Keychain that both certificates are not expired.

I verified the time on my Mac is accurate as well.

[Farhan Mohamed]

Please see the below discussion if it helps:-

https://supportforums.cisco.com/discussion/13215426/certificate-enrollment-failed#comments

[archspangler]

Not really any help.

[Farhan Mohamed]

There are some issue with the current VPN incompatibility with the MAC OSX 10.1 and above. Keep waiting for the latest release. I will keep you posted. That should solve the problem!

(Do rate if useful)

[adamvanto]

Any updates on this issue?  do Anyconnect able to finally read the certificate in the keychain yet?

[jessesanford]

Anyone have any info on this? This seems to be exactly the problem I am having as well.

[Ryan Cresswell]

Having the same issue. When I try to connect it doesn't even attempt to make a connection. does a dns lookup and not even a syn packet to the asa. So it definitely a local issue.  I do get this msg in the event log.

Function: COpenSSLCertificate::VerifyKeyUsage
File: .\Certificates\OpenSSLCertificate.cpp
Line: 2137
Invoked Function: COpenSSLCertUtils::VerifyKeyUsage
Return Code: -31391723 (0xFE210015)
Description: CERTIFICATE_ERROR_VERIFY_KEYUSAGE_NOT_FOUND:No Key Usages were found in the certificate