AnyConnect with Computer certificate authentication

[KevinYounil1]

Hello,

I have successfully implemented Anyconnect in our network, I am using user certificates and ACS for authentication. I face an issue when I try to use computer certificate instead of user certificate for authentication. I should mention that I have tested following options in any connect client profile:

Certificate Store: All and Machine

Certificate Store Override enabled.

Has anyone any idea about that?

[Rahul Govindan]

Could you provide details on the issue you are facing? Are you getting any particular error message or is it not picking up the certificate from the machine store? 

[KevinYounil1]

Hi Rahul,

It's like there isn't any valid certificate on the client, I get this error message when I change Certificate Store to Machine.

[Mohammed al Baqari]

Can you look in your machine and make sure that your machine download the
anyconnect profile with machine certificate setting

[KevinYounil1]

Hi Mohammad,

Yes I did, it is downloading the new profile and setting shows store has been set to Machine.

[Rob Ingram]

Are you logged in and attempting to connect to the VPN as a non-admin user? Only an administrator can access the local certificate store. Quick test, open an MMC attempt to add the certificate snap-in, if you can only select "Certificates - Current User" then the user you are logged in as is a non-admin user and cannot access the computer certificate store.

FYI, In my lab, I am using a machine certificate with AnyConnect VPN client and this works fine, however I'm logged in using an administrator.

HTH

[KevinYounil1]

No I am Admin on the client and able to see the computer certificate. Does getting authenticated with user certificate mean that certificate configuration is correct on ASA? I mean trustpoints, . . .

[KevinYounil1]

has anyone any guide to verify the steps for certificate authentication?

[silvpietr]

Hi!

This is an old topic, but I suspect you do not have the ROOT CA which has signed the Machine Cert in your Appliance/ACS (not sure how your ACS policies are for Auth/Authorization - but certificates are usually verified on the appliance level and then the cert attributes are extracted, mapped and sent to ACS/ISE for validation against an identity store). Make sure you look for the gateway logs and you should see there the reasons.

HTH.