ASA Secure-client Machine Cert Authentication

[Najib Akbari]

I have and ASA configured for AlwaysON SSL-VPN Certificate Authentication which is working fine but I want to change to computer based Authentication and the change I made is changed connection profile -> Primary field --> changed from  "UPN" to "CN" and its failing. please help.

also, what do you think of changing from user based cert to machine based cert Authe. is it better security wise? the reason i want to change is because if its user based then the user at least have to login one time and add cert or push it auth from domain. though? 

[Najib Akbari]

Please help me know what requirements I add and or change to switch from user cert Authentication to Windows computer cert Authentication?

[Najib Akbari]

Also, Please let me know if Better to keep ASA as local Authentication there or move it to ISE? right now ASA does authentication and ISE does Authorization

[Rob Ingram]

@Najib Akbari Why not use double authentication? - computer certificate + AAA authentication via ISE using the users AD credentials. That would be more secure than just computer or user certificate authentication.

[Najib Akbari]

I agree, its just for the user convenienca for now they want computer cert auth. which Im having issue bringing it up

[Rob Ingram]

@Najib Akbari run debugs and provide the output for review.

debug webvpn AnyConnect 255
debug crypto ca 255

[Najib Akbari]

the only output from CLI:
SSL verify callback: Key exchange algorithm extracted from SSL Cipher

and the always on profile:

[Najib Akbari · Accepted solution]

For anyone needs to know and might help them:

its fixed!

it turned out to be Public key RSA key length on computer 1024 mismatched with ASA RSA key length 2048. changed the policy on domain for computer cert to 2048 and request the new cert on windows machine, then AlwaysOn VPN based on computer cert started working