AnyConnect Certificate Security Warning for ASA IP?

[PeterLin09157]

Hi,

We're getting a Security Warning when we try to login with our AnyConnect clients to vpn.domain.com.

The warning shows the IP address of vpn.domain.com instead of the domain-name? We have a valid DigiCert wildcard certificate for *.domain.com installed on the ASA firewall. We've tried with different client versions. We've seen that laptops that are not part of our AD domain, don't get the warning. Any ideas or anyone experienced this before?

Best regards,

Peter

[Rob Ingram]

Hi @PeterLin09157 

Do the domain joined laptops have the DigiCert Root/Intermediate certificates in the certificate store?

Are these non domain joined computers connecting to the same FQDN and Tunnel-Group as the domain joined computers?

[PeterLin09157]

Hi @Rob Ingram 

Thank you for your reply. The domain laptops have the DigiCert root and intermediate certs installed in windows cert store. Also thought of this. The non-domain computers connect to the same FQDN and tunnel-groups.

Best regards,

Peter

[Rob Ingram]

You've amended your screenshot and typed IP address, are you connecting to the IP address or the FQDN? If you aren't connecting to the FQDN then you would receive and error, use the FQDN of the domain as defined in the certificate.

[PeterLin09157]

We're of course using the FQDN to connect. That's why I'm perplexed that the warning states the IP address.

[Rob Ingram · Accepted solution]

So are you manually typing in the FQDN or do you have a pre-configured profile defined and you selecting the VPN from the list? If using a profile double check what is configured.

Run a debug on the ASA and run wireshark on the laptop, connect to the VPN tunnel and provide the output here for review.