Anyconnect VPN server certificate error

[robandover385]

We have an ASA that we use just for our VPN and we use Cisco DUO on it for MFA. This is all setup and working for our Windows users, but once I upgraded the Cisco Secure client version to 5.1.14.145, it broke for our couple of MacOS users. If I switch the client version back to 5.1.12.146, then everything works with out errors. At the moment on version 5.1.14 when we click connect then for a split second it pops up with secure client window to select the authentication process for DUO, then it goes away and we get the "Authentication failed due to problem verifying server certificate". I have went into keychain and trusted the certificates that the connection is using for the VPN, but still get the same error. I have removed them and added them back, double check that none are expired. Weird that it works in 5.1.12 but not with version 5.1.14, then also Windows devices are all still working.

[pieterh]

maybe this applies?

• Any 5.1.8 users who upgraded to 5.1.13 prior to November 20, 2025 require no further action to resolve the trust bundle issue described in Cisco Secure Client 5.1.13.177 New Features. Users who are running 5.1.9 to 5.1.12 should refer to the expiry dates listed in Cisco Secure Client 5.1.13.177 New Features to avoid upgrade issues.

  Release 5.1.14 contains a fix for CSCws30211, which prevents an upgrade to those Windows devices not upgraded prior to the expiration dates detailed in CSCws02283.

  Those Windows users affected by CSCws00283 whose devices are beyond the specified expiration dates must upgrade to 5.1.14.145 (or later). MacOS users affected by CSCws00283, and Windows users affected by CSCws00283 whose machines have not yet reached the specified expiration dates, can upgrade to 5.1.13.177 (or later).

as I read this, you may need to upgrade from 5.1.12.x to 5.1.13.x first,  before you can advance to 5.1.14.x

[robandover385]

We originally were running 5.1.12 when it was working and I saw that about upgrading to 5.1.13 so I did that 1st, but then still got that error message, so then I decided to see if 5.1.14 had the fi but didn't. I am not able to see CSCws02283, because it is not availble to the public at the moment. Also all our Windows devices are working fine on 5.1.14, this is really only affecting like 5 MacOS users.