Certificate Management on Cisco VPN 3000 Concentrator

[a.medusei]

Hi,

I need to install certificates on Cisco VPN 3000 Concentrator.

The problem is I've a root CA Certificate of 4096 and I can't import it.

Anyone know how I can solve this problem?

Any suggestion?

[gfullage]

The VPN3000 does not currently support cert sizes of 4096 unfortunately. Cert processing is done on HW and the HW doesn't support it at this time.

[shawnmchenry]

We just went through this...

According to Cisco you have two choices:

(1)Await the next round of VPN products that will support CA root certificates generated with a 4096 bit key

(2)Scrap your existing CA infrstructure and start over by generating a CA root certificate using a 2048 bit key. This is what we ended up doing. We revoked 30K certificates, rebuilt our CA servers and started over.