ASA - local CA replacement for user certificates mgmt

[lkovar]

Hello,we want to migrate ASA to a failover cluster, but we must delete the local CA, because it is not supported there.

What CA do you use in such scenario for managing users and their certs? We tried MS AD CA, which worked fine for Identity certificate but seems to me too complicated  to manage VPN user certificates. Do you suggest MS AD CA, yet ,  or there is a more lightweitght alternative ?

Many thanks

[Rob Ingram]

Hi,

MS CA works well for certificate authentication on ASA RAVPN and is relevatively straight forward, example here.

Use MS GPO to distribute the certificate to the users/computers.

HTH