IOS CA for SSL VPNs

[newtwork1]

How would you configure an ios ca server to authenticate SSL vpn users when not using a domain name?

My public IP is (for example) 1.1.1.1. I will not be using this with a domain name. How can my CA server / trustpoint be configured to prevent users from getting certificate errors after the certificate has been installed?

I have the ssl vpn up and working I can even login using AnyConnect2.3, just not 2.5. I know a work around for this is to modify the hosts file, but is there another way around this through configuring the CA server or trustpoint? Thanks for the help.

Newt.

[Herbert Baerten · Accepted solution]

Hi Newt,

To avoid the warning about a name mismatch, make sure the CN of the certificate contains the IP address of the SSLVPN gateway.

e.g.

cry ca trustpoint blah

  subject CN=1.1.1.1

then (re-)enroll the trustpoint to get a new certificate with the correct subject.If the users have the CA cert installed, then they don't need to change anything . If they have the server cert installed, they will have to install the new one.

hth

Herbert