Single wildcard cert across multiple ASAs?

[the-lebowski]

Is this even possible?  I assume not because I have to generate the CSR on the ASA's themselves and I can't do that on everyone and use the same wildcard cert correct?  Just looking for an easy to manage ASA certs across my environment.  

[Karsten Iwen]

Yes, that can be done. From a security-standpoint not the best idea, but for sure easy to manage.

Do you already have that cert? You need it as a PKCS-12 file (PFX) which you can import into he ASA. If you don't have it yet, you can generate the CSR on any of the ASAs or even on a different system. I always generate my CSRs in situations like these on my Mac with OpenSSL. After getting the cert from the CA, it has to be converted to PFX which again can be done with OpenSSL.

[the-lebowski]

Thanks and I tried that but get a couple errors, one when creating the PKCS file and another when I attempt to import it.

1. 4294956672:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:evp_enc.c:529:
4294956672:error:0906A065:PEM routines:PEM_do_header:bad decrypt:pem_lib.c:488:

2. ERROR: Import PKCS12 operation failed. Base64 decode failed.  

No idea where or what the problem is. 

[Karsten Iwen]

How do you generate the file? And when importing, do it in ASDM, that typically works better than on CLI.

[the-lebowski]

I didn't, I already had a wildcard cert that I am trying to use.  Using ASDM as well but I assume something wrong with my cert/key files.  

[Karsten Iwen]

do you have openSSL on your PC? Then you can at least check the file:

openssl pkcs12 -info -in file.pfx

[the-lebowski]

This is what I did:

$ openssl pkcs12 -export -inkey wildcardnew-k.pem -in wildcardnew.pem -name "wildcard" -out wildcard-asa.p12
Enter pass phrase for wildcardnew-k.pem:
unable to load private key
4294956672:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:evp_enc.c:529:
4294956672:error:0906A065:PEM routines:PEM_do_header:bad decrypt:pem_lib.c:488:
 

$ openssl pkcs12 -info -in wildcard-asa.p12
4294956672:error:0D07207B:asn1 encoding routines:ASN1_get_object:header too long:asn1_lib.c:157: