Hi Nilorac,
The notes on the link I prevously posted are helpful, I just followed those. When you say from a MAC, to be clear I also used a MAC but used CLI and NOT ASDM. There are possibly multiple ways to achieve this but this is what I did.
Create a base 64 encoded pkcs12 certificate file.
On the ASA5510:
Confirm what trust point certificates already exist on the device:
MAIN_ASA(config)# show crypto ca trustpoints
Expect to see something like this, there could be more than one:
Trustpoint {your cert name EG]:bob.net
Subject Name:
cn=GlobalSign Organization Validation CA - G2
o=GlobalSign nv-sa
c=BE
Serial Number: [unique certificate number here]
Certificate configured.
As a backup export the current certificate(s) out to a pkcs12 file format:
MAIN_ASA(config)# crypto ca export bob.net pkcs12 {create a long password}
copy the output to a file and also save the password with it
Import a new certificate:
MAIN_ASA(config)# crypto ca import bob.net-sha256 pkcs12 printer
Paste the contents of the base 64 encoded pkcs12 file you have already created.
Ensure the contents have a BEGIN and an a END statement
THEN
After pasting, on a new line End with the word "quit"
See below
-----BEGIN PKCS12-----
MIIGDj****************************************************wFADCB
....
....
....
....
MIIGDj****************************************************wFADCB
-----END PKCS12-----
quit
INFO: Import PKCS12 operation completed successfully
Prove the new trust point cert has been imported corrected:
MAIN_ASA(config)# show crypto ca trustpoints
Expecting to see both:
Trustpoint bob.net
Subject Name:
cn=GlobalSign Organization Validation CA - G2
o=GlobalSign nv-sa
c=BE
Serial Number: [unique certificate number here]
Certificate configured.
Trustpoint bob.net-sha256:
Subject Name:
cn=GlobalSign Organization Validation CA - SHA256 - G2
o=GlobalSign nv-sa
c=BE
Serial Number: [unique certificate number here]
Certificate configured.
I then disabled requests pointing at the OLD certificate as we no longer needed this
MAIN_ASA(config)# no ssl trust-point bob.net
Point SSL requests at the new certificate
MAIN_ASA(config)# ssl trust-point bob.net-sha256
Confirm this has worked:
show run | i trust-point
NB without knowing what setup, version, configuration you have running I have no control over the inpact of reapeating the above will have on your device, you do this at your own risk.
