Cisco Anyconnect VPN getting Untrusted server certificate error

[amitspanchal]

I am getting untrusted server certificate error while connecting to the VPN. I have installed the certificate and is showing valid.

Note the certificate is wildcard certificate.

[Rob Ingram]

@amitspanchal

I assume the FQDN used in anyconnect matches the wildcard domain?

Have you enabled this certificate trustpoint on the outside interface?

ssl trustpoint <trustpoint name> OUTSIDE  

...otherwise the ASA will not be using that certificate.

[amitspanchal]

Yes ROB,

I have enabled this certificate on the outside interface.

ssl trust-point Hobasa_cert
webvpn
enable outside

[Rob Ingram]

Ok, I can see you are attempting to connect to the IP address 27.10*.*.* not the FQDN. It will display this error, you need to connect to the FQDN that matches the wildcard domain.

[amitspanchal]

Hi Rob,

Thanks for your response. So suppose I have a wildcard certificate which is issued to *.abc.com and if I create a DNS entry for my firewall on the internet like firepower.abc.com and use this FQDN for Anyconnect VPN. So after that will I be getting the same certificate error?

[Rob Ingram · Accepted solution]

@amitspanchal if you create and FQDN called firepower.abc.com and connect to firepower.abc.com from anyconnect/secure client and the wildcard on the FTD is *.abc.com you will not receive the certificate error. The FQDN used to connect to the VPN must be valid on the certificate. You are receiving the error because you connect to the IP address, which obviously does not match the wildcard domain.

[MHM Cisco World]

Thanks 

MHM

[amitspanchal]

Hi Rob,

This thing worked for me. Thank you very much for your help.