AnyConnect client perform revocation check on ASA server cert? Can be configured?

[daboochmeister]

Environment:  AnyConnect Secure Mobility Client v 3.1.04066

Does the AnyConnect client perform a revocation check on the server certificate returned from the ASA during a VPN connection setup?  If so, does it use the info in the server certificate AIA, or can the OCSP or CRLDP URL be configured in the client?

And, can server certificate revocation checking be disabled (e.g. in the profile, or a registry update)?

Note, I'm NOT talking about the ASA checking revocation on submitted client certificates.  All of my vast google-fu could only uncover info about that topic - but this is different, this is akin to a browser checking revocation on a website's server certificate.

We are evaluating using an identity certificate from an internal CA for the VPN profile - but there's a catch-22/chicken-egg problem if the AnyConnect client does a mandatory OCSP check on the cert, since it won't have access to the OCSP URL until after connected. This could be addressed by e.g. having an outside CRLDP URL to a .crl file, or suppressing revocation checks in the AnyConnect client.

Thank you!

[jan.nielsen · Accepted solution]

I believe that at some point this was removed from anyconnect, as it was the cause of many problems, but was reintroduced in anyconnect 4.1, but still not enabled per default. So no, i don't believe that the version you are running is doing this.

[daboochmeister]

jan.nielsen, I had concurrently opened a TAC case on this question, and received back the same answer you gave (but you beat them by several hours :-).  Thx!  Oh, and 4.1 only added in CRL checking, not OCSP, according to their reply.