Certificate Matching and Certificate Store issue

[Rafa]

Hi there, just a Little question.

One Month ago, I have changed to the Local CA from the ASA with self signed Certs, created by the ASA self.

I have set the XML Profile to Certificate Store: All and a Certificate Matching.

Now, I have installed the certs in the Trusted People Store.

Why does AnyConnect not look in this Store?

Do I Need Admin rights to go to this Store?

Best regards

Rafael

[Rahul Govindan · Accepted solution]

'All' here represents both User and Machine store. But Anyconnect looks into the Personal store , where user certificates with private keys are usually stored. For User store, you don't need Admin rights, but Machine store usually does. You can grant Anyconnect privileges to look into that store by enabling the Certificate store Override on the XML profile.

[Rafa]

I thought, I've tried that too, but no success.

I will test it again and let you know.

Thanks in Advance

Best wishes

Rafael

[Rafa]

Hi there.

SO I have tested the setting:

CertificateStore - ALL

CertificateStoreOverride - true but no success.

The Certs are in the Path: Current User\Trusted People\Certificates

When I copy them to the Folder: Current User\Personal\Certificates, AnyConnect will start the Connection and check with the local CA.

Is there any other possibility, to let AnyConenct check in another Store? Not just the personal store?

Best regards

Rafael

[Rahul Govindan · Accepted solution]

Unfortunately, there is no setting to change this on the ASA or the client. The client is always going to check in the Personal store as that is where User certificates (and associated private key) should usually reside on a Windows system. Trusted people store is usually meant for self-signed certs or certs that are explicitly trusted by any application.

[Rafa]

Ok, so I have to install the certs in the Personal Store.

Thanks a lot for your help.

Sincerly yours

Rafael