ASA PKI CA and IPSEC VPN

[Chris Lester]

Hi All,

I have an ASA which terminates IPSEC VPN’s from both internal/private networks and from Public/3rd Party networks at the Edge.

Can an ASA5500x running IOS9.3.x  register (trust points / enrolments) with multiple CA’s ?  (Private and Public)

For example could I , on one side have an Internal and private registered CA, but on the Public side register with for example Verisign / GeoTrust, etc ? 

If this can be supported, what domain-name should be used, as the internal domain-name is country.companyname, which i assume would not be what the Public CA provider would want  (companyname.com for example) ?

Thanks for your help and feedback.

Chris.

[Peter Koltl]

Why not? You can use multiple certs and multiple trustpoints (i. e. CA certs). Place a suitable FQDN into either cert.