Iphone and Cisco VPN with Certificates

[the_tester]

Hi,

I am trying to make this thing working. Iphone has a feature where you can connect to an ASA using the certificate method.

at the moment, I can connect using the anyconnect client for Windows, but i can't connect using Apple products. I am getting a certificate error.

I found some old discussions about this, so i am wondering if anyone could help: Basically:

- My ASA has a hostname like myhost.mydomain.com.au

- the certificate has myhost.mydomain.com.au as SubjAltName. The certificate is signed by an External CA.

the phone connects (i can see the connection attemp from the logs), but the connection end with "Could not validate server certificate" . I have seen many people that said that the subjaltname in the certificate must be the same as the hostname.

but still doesn't work.

any clues?

thanks

[gaigl]

Hi,

your IPhone has the root-certificate of the external CA installed?

your ASA has the root-cert installed and in the same Trustpoint a Identity-Cert of this CA?

In your TunnelGroup (ConnectionProfile) is the correct Trustpoint selectet?

In the settings of the root-cert on the ASA is the intended usage activated (ssl and/or ipsec)?

settings of CRL's?

[the_tester]

thanks for your post Karl.

- yes

- yes

- yes (there is also another bug (of hundreds) i ve found on ASDM, you have to put the command manually). Not to mention the nat-traversal bug that took me days to figure out (of course, no documentation whatsoever by Cisco)

- yes

- CRL created based on information i ve found (of course not eigher Apple or Cisco are providing precise documents).

Every time you look for something at Cisco, let s say how to replace a wheel on your car, they will start telling you of all the types of wheels that exists in this world since the wheel has been invented 5000 years ago, the molecular compositiion of the plastics, the lenght of every single pin and treat of the metal compositions of the pins, and guess what? they dont actually tell you how to replace the wheel.

Sorry  i m a little frustrated, everything with Cisco, even the easiest thing, is so damn complicated.