anyconnect+SAML - failed due to problem verifying server certificate

[MarkKruse5137]

I've gone through a couple of documents for setting up AnyConnect with Azure SAML. The configuration part seemed to go fine, but when the VPN client tried to connect it returns the "cisco secure client authentication failed due to problem verifying server certificate" error. The ASA certificate was issued by an internal CA and both the ASA and client trust this CA.

Not sure what I'm missing here?

Any help would be appreciated.

[Pavan Gundu]

You need to confirm if the SSL handshake is getting completed before we look into troubleshooting SAML.
Try taking capture on the outside interface and dump it into pcap and analyze in wireshark. Capture command for reference:-

capture capout interface outside match ip host <FW-Outside-IP> <Client-Public-IP>
sh cap capout dump

[MarkKruse5137]

Hi Pavan,

Thanks for the info. I ran the capture, but I'm not sure what I'm looking for. From what I can see the handshake is complete. There is a line "TLSv1.2 Record Layer: Alert (Level: Fatal, Description: Certificate Unknown)" that kind of sticks out.

[Pavan Gundu]

What kind of certificate is this? A self signed one or is it signed by some well trusted CA?

[MarkKruse5137]

No. The ASA certificate was issued by an internal CA and both the ASA and client trust this CA

[Pavan Gundu]

Can you send those captures and also the DART bundle with timestamp if there is DART module installed on your secure client?

[MarkKruse5137]

Where can I send it?

[msmoak]

Mark, were you able to find a solution? I am having the exact same problem.

[Milos_Jovanovic]

Because SSO is in use, with multiple communication flows, including Azure sending assertion back to ASA, certificate on the public side must be signed by public/trusted CA. If Internal PKI is used, errors like these happens, regardless of ASA and client trust eachother (Azure doesn't trust your PKI).

Kind regards,

Milos

[gajownik · Accepted solution]

This error happens when the server certificate is not trusted by the PC. Untrusted server certificates are not supported with an Embedded Browser:

------------------------------------------------------------------------------------------------------
When using SAML with Secure Client, follow these guidelines:
- Untrusted server certificates are not allowed in the embedded browser.
------------------------------------------------------------------------------------------------------
https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/730/management-center-device-config-73/vpn-remote-access.html#reference_pdf_cx3_psb

In order to troubleshoot this issue please open a browser and visit the same URL that you have in your connection profile. Do you see browser error informing about untrusted certificate? If yes then internal root CA and/or subCA certificate is not installed correctly.
Location where certificates should be installed depends on the browser and the operating system. For example Firefox by default does not use system store and has it's own one.