Firepower anyconnect certificate

[Amills]

I'm trying to configure anyconnect and I'm getting hung up on the certificate part. It says I can get a cert from a trusted CA, such as GoDaddy. On the old ASA firewalls I'd generate a CSR and get GoDaddy to sign it but none of the tutorials on setting up Anyconnect go through a CSR generation steps, it just says, "obtain them from a trusted Certificate Authority". 

I'm a bit confused how to go about getting a certificate. 

[Rob Ingram · Accepted solution]

@Amills 

Use the Manual Enrollment method on this link if you use FMC

https://www.cisco.com/c/en/us/support/docs/security-vpn/public-key-infrastructure-pki/215849-certificate-installation-and-renewal-on.html#anc7

If using FDM to manage the device use this guide.

https://www.cisco.com/c/en/us/support/docs/security-vpn/public-key-infrastructure-pki/215849-certificate-installation-and-renewal-on.html#anc7

[Amills]

3. Specify a Name for the trustpoint and under the CA Information tab, select Enrollment Type: Manual. Enter the pem format certificate of the CA that will be used to sign the Identity Certificate. If this certificate is not available or known at this time, add any CA certificate as a placeholder, and once the identity certificate is issued repeat this step to add the real issuing CA as shown in the image

What does this mean? I went through the steps and got a CSR but how do I got back and repeat that step? Does it mean to make a new Certificate and then use the ID cert I just got from GoDaddy and copy and paste that pem format certificate in?

[Rob Ingram]

@Amills 

Looks like you cannot go back to the Cert Enrollment object and add the CA certificate later.

What you could do is create another Cert Enrollment object, select Enrollment Type as Manual, tick the box "CA Only" and paste the CA certificate. Go to Devices > Certificates and deploy this CA Only object to your FTD.

[Aref Alsouqi]

Please take a look at this post of mine on my blog and let me know if it helps, you can change the enrolment type:

FMC AnyConnect SSL VPN | Blue Network Security (bluenetsec.com)

Also, if you fancy reading please check out our book at:

Amazon.com: CCIE/CCNP Security Exam 300-710: Securing Networks with Cisco Firepower (SNCF): Volume II (Todd Lammle Authorized Study Guides): 9798711168409: Lammle, Todd, Robb, Donald, Alsouqi, Aref: Books