11-12-2012 04:37 PM - edited 02-21-2020 06:28 PM
We currently have an ASA 5505 Firewall with VPN services configured. The system is running ASA Version 9.0.0 and ADSDM 7.0.2. I installed the "Cisco AnyConnect Sercure Mobility Client" Version 3.1.01065 on my Windows 7 Ultimate PC. When I try to connect to my VPN service I ge the following message:
Security Warning: Untrusted VPN Server Certificate! AnyConnect cannot verify the VPN server: XXX.XXX.XX.XX
Certifiate does not match the server name
Certificate is from an untrusted source.
Certificate is not identified for this purpose.
Without purchasing a certificate from a 3rd Party vendor, is it possible to register a "Self" generated Certificate to get rid of this message? If so are there any "Detailed" (e.g., simplified or not in Cisco-eeze language) instructions on how to setup the Firewall to "push" the certificate to the VPN client so the message doesn't come up for the user?
Solved! Go to Solution.
11-13-2012 03:51 PM
I may have incorrectly assumed your remote access VPN ever worked.
Comparing your error message with the one I get when I tell my client to block connections to untrusted servers shows that I get a single, different warning screen (below). I suspect you may have more than just the client side issue. Can you share your configuration?
11-12-2012 06:47 PM
You can simply accept the self-signed certificate the first time you are presented with that message and direct AnyConnect to always trust such certificates.
If you don't want to do that, you need to make your clients automatically trust this certificate from your ASA. You can do that several ways. You mentioned using a 3rd party vendor - that ends up being the method of using a vendor in the trusted root Certificate Authority (CA) list. If you don't use one of the 3rd party ones, you will need to push out the trust via some software deployment method - e.g. a GPO for Windows clients in a managed AD setup or via pre-deploying with yet another 3rd party tool like LANdesk.
If you don't have an internal CA or AD-managed infrastructure for your clients then just telling users to click "always trust" is the path of least resistance (although the least secure).
11-13-2012 07:45 AM
In the prior version of the VPN Client I saw this option. In the new version, I don't see where you can accept the self-signed certificate.
11-13-2012 08:44 AM
When you click "Connect Anyway", I believe you get an option to then choose "always" or some such.
What you end up with is this setting (no check next to "Block connections from untrusted servers") in your Anyconnect preferences:
11-13-2012 11:12 AM
11-13-2012 03:51 PM
I may have incorrectly assumed your remote access VPN ever worked.
Comparing your error message with the one I get when I tell my client to block connections to untrusted servers shows that I get a single, different warning screen (below). I suspect you may have more than just the client side issue. Can you share your configuration?
05-26-2017 09:43 AM
05-26-2017 09:45 AM
05-26-2017 06:17 PM
Your ASA appears to be using a self-signed certificate and/or one that does not have the Fully-Qualified Domain Name (FQDN) matching the Common Name (CN) field of the certificate.
Getting a signed certificate from a trusted public Certificate Authority (CA) and making sure that your Certificate Signing Request (CSR) has the correct CN will usually fix that issue.
If you click on "Connect Anyway" does it proceed to connect successfully?
05-28-2017 01:12 AM
Hello Marvin
Thank you for the reply .
I dont see any cert is actually in the ASA .
When i click "Connect Anway" it simply disconnected with failed certificate error . "No valid certificate available for authentication"
Would it be possible to have a remote vpn connection setup without certificate ?
I use to have a ASA 5505 before and there was no such issue.
even i set the profile only to use AAA .
05-28-2017 07:32 PM
Since AnyConnect fundamentally uses SSL VPN, you must have some sort of certificate - either CA-issued or self-signed. (There is an obscure corner case of strictly IKEv2 AnyConnect remote access VPN but it is very rarely used outside of areas where it is required for mainly governmental compliance reasons.)
Check under the top level menu of your Connection Profile for a certificate. You may have a malformed entry specified there or inadvertently deselected the self-signed certificate that is commonly used.
11-13-2019 11:29 PM
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide