ASA and SHA-256 certificates

[Jacob Zartmann]

Hi,

I was wondering when and if ASA will support certificates with SHA-256? I know IOS does support it already...

Thanks,

/JZN

[Jacob Zartmann]

Just stumbled upon this:

http://www.cisco.com/en/US/docs/security/asa/asa82/release/notes/asarn82.html#wp418483

Looks like asa finally has support for SHA-256

/JZN

[Jacob Zartmann]

Well... I upgraded our ASA to version 8.2(4) asa824-k8.bin and get this error when trying to authenticate our CA servers certificate:

crypto ca trustpoint my_ca
enrollment terminal
crl configure

crypto ca authenticate my_ca
Enter the base 64 encoded CA certificate.
End with the word "quit" on a line by itself
-----BEGIN CERTIFICATE-----

blah blah blah

-----END CERTIFICATE-----
quit

INFO: Certificate has the following attributes:
Fingerprint:     .....
Do you accept this certificate? [yes/no]: y
% Error in saving certificate: status = FAIL

CRYPTO_PKI: can not set ca cert object (0x722)
CRYPTO_PKI: status = 65535: failed to process RA certificate

I've tried to authenticate the CA certificate on a 5505 with version 8.4(1) asa841-k8.bin and it was successful.

What's going on with the version I'm running ? I really don't want to upgrade to anything beyond 8.2(x) as a lot of rewriting has to be done with the new way of doing NAT and so on...

Any suggestions?

Thanks

/JZN

[andamani · Accepted solution]

Hi Jacob,

Could you please confirm the signature Algorithm used by the certificate?

Is it SHA2?

You are using 8.2.4 code i guess. Support on SHA2 is there until 8.2.4.1. I believe so either you can upgrade the code to 8.2.4.1 and check.

Regards,

Anisha

P.S.: Please mark this thread as resolved if you feel your query is answered.

[Jacob Zartmann]

Of course... My mistake. I'll have to upgrade to the Interim release...

Thank you.

/JZN