ASA only uses self-signed certificates after upgrade to 9.4.1

[Marquardt.Daniel]

I ran into a strange issue after upgrading to 9.4.1... (coming from 9.3)

However i access the ASA (Browser, Anyconnect, etc.) it only offers a self-signed certificate even though a proper SSL certificate is installed.

I checked:

ssl trust-point VPN_Portal_TP
ssl trust-point VPN_Portal_TP outside
ssl certificate-authentication fca-timeout 5
ssl certificate-authentication interface outside port 443

is configured.

• CA Certificate is installed, too.
• Reinstalled all certififcates.
• Re-assign the Trustpoints

Any idea would be greatly appreciated.... thank you!

[Marvin Rhoads · Accepted solution]

I haven't gotten time to test this out on my lab unit yet but there's a related thread here.

I'm not positive on the standard resolution just yet - it'll bear close watching.

Perhaps the first person to open a TAC case can share the resolution.

[Mario Jose Mora Vargas]

This is properly documented on the release notes of 9.4.1;

http://www.cisco.com/c/en/us/td/docs/security/asa/asa94/release/notes/asarn94.html#51000

Regards.

[Marvin Rhoads]

mmoravar,

Please see the thread I linked to - it contains a user reporting that the documented fix is not working.

[Marquardt.Daniel]

Well, to be honest, this feels like a bad design choice - assuming a brand new feature to be a "default" setting so "cipher" overrules it all. 

Most customers / owners of an ASA have paid SSL certificates of a trusted CA in place and running - so many more will run into this potentally.

Anyway, using

AES256-SHA:AES128-SHA:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:RC4-SHA

as the custom string as mentioned (so excluding all cipher) did the trick.

Thanks Marvin for the hint!