sslvpn error on ios: CRYPTO_PKI: Can not select private key (keyname)

marlon.cabusao.malinao · ‎03-13-2011

Hi guys,

i have a cisco 2801 router which is running sslpvn, previosly my sslvpn is working, but when i reset the config to factory default and restore the working config, then i experienced this problem;

here is my crypto config

here is the error:

CRYPTO_PKI: Can not select private key (keyname)

===============

crypto pki trustpoint keyname
enrollment selfsigned
revocation-check crl
rsakeypair keyname
!
!
crypto pki certificate chain keyname
certificate self-signed 01
30820228 30820191 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
21311F30 1D06092A 864886F7 0D010902 16104D43 4D525452 30312E6D 636D2E6E
6574301E 170D3130 30393136 31333237 35365A17 0D323030 31303130 30303030
305A3021 311F301D 06092A86 4886F70D 01090216 104D434D 52545230 312E6D63
6D2E6E65 7430819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100B44C 8146DB4C 0BC9C0DF 675ED418 0394BEF1 18A27E70 33CE2CAD CB3B4C14
2966CDB8 5BEA4B9E 104DE138 D9B9DE1B EF0D25E6 CE37839E 457B7403 0040255B
69439653 880A56C7 4E8D6D93 8E20372A CE2B6733 A6C514A8 2F581C3B 5F317B0D
7C9CD0F6 4DF025B8 5AB005CD BA4F7ACD 30DCE199 BED91F93 39B898CC 21972357
8C830203 010001A3 70306E30 0F060355 1D130101 FF040530 030101FF 301B0603
551D1104 14301282 104D434D 52545230 312E6D63 6D2E6E65 74301F06 03551D23
04183016 80142169 F245ED88 985FEBAA 711EE3EB D55A5AF7 F053301D 0603551D
0E041604 142169F2 45ED8898 5FEBAA71 1EE3EBD5 5A5AF7F0 53300D06 092A8648
86F70D01 01040500 03818100 012D8ACC E2F99CDB 4683AA87 FAAE2E72 EC452835
F1D985C2 981CC017 4D68064F 6A5362B4 8F43DAFE 44CB14F1 2541BB73 CD5042F2
A3B7F10D D1944EC4 D54EE029 21A81EC3 43E4D26E C63AEC65 7F2BCCC1 1347C9AC
792EA822 17F18A2C 340299A3 E275FB53 37B77F80 8E93B759 C9C4BCFA FC6E4A3F
622FE184 3861FF48 560B1C2E
quit

webvpn gateway webvpn-gateway
hostname sslvpngtwy01
ssl trustpoint keyname
inservice

rgds,

marlon

andamani · ‎03-13-2011

Hi,

Could you please paste the output of "sh cry key mypubkey rsa".

Regards,

Anisha

P.S.: please mark this post as answered if you feel your query is resolved. Do rate helpful posts.

marlon.cabusao.malinao · ‎03-13-2011

hi,

MCMRTR01#sh cry key mypubkey rsa
% Key pair was generated at: 06:09:12 SG Mar 12 2011
Key name: MCMRTR01.mcm.net
Storage Device: private-config
Usage: General Purpose Key
Key is not exportable.
Key Data:
30819F30 0D06092A 864886F7 0D010101 05000381 8D003081 89028181 00A8913C
665E9B48 DEF6FD8C AB4ED933 375795D8 5F851E65 88F64D6A 60E5F47B 015774B6
7C32924F 8424885C 28A142F0 B1C69936 F0BACC8D 79FD67F0 A6F71644 C4D97E5A
A5FBE5AC DB084EA5 198461A4 21BB234D 4FB87C5C EBAF37C1 660D67A8 35F6E54B
E2770471 C9F3500F DA956941 96858A68 3A20C1C4 CE5FC77C 8E46B27E 3D020301 0001
% Key pair was generated at: 21:38:20 SG Mar 13 2011
Key name: MCMRTR01.mcm.net.server
Temporary key
Usage: Encryption Key
Key is not exportable.
Key Data:
307C300D 06092A86 4886F70D 01010105 00036B00 30680261 00D1BFEE 1527DA27
9D2190BE 4899D6EA D873982D 415D2394 B24481D9 A92DF98A 4D643733 E2E9A14F
33A85E9D F476506D A5107C3E B22A53CA 3B9532C8 117068FF 525C6BB4 9A76D258
D4928024 5C8938EC 202B5306 3A02CE91 EC28B985 3B3BCDC1 DF020301 0001

andamani · ‎03-13-2011

Hi,

You don't have a keypair by the name "keyname" present. hence it is throwing the error.

Please generate a new private key with the keypair name "keyname", delete the trustpoint config then add it again and generate a new certificate.

Hope this helps.

Regards,

Anisha

P.S.: please mark this thread as answered if you feel your query is resolved. Do rate helpful posts.

marlon.cabusao.malinao · ‎03-13-2011

hi,

thanks, can you show me how to do this?

Sent from Cisco Technical Support iPhone App

andamani · ‎03-13-2011

hi,

the following link gives details of how to configure ssl vpn on router:

http://www.cisco.com/en/US/products/ps6496/products_configuration_example09186a008072aa61.shtml

Anyconnect configuration on router is described as below:

http://www.cisco.com/en/US/products/ps6496/products_configuration_example09186a0080720346.shtml

Certificates on router:

http://www.cisco.com/en/US/docs/ios/12_3t/12_3t14/feature/guide/gtpsscer.html#wp1027188

Regards,

Anisha

P.S.: please mark this thread as answered if you feel your query is resolved. Do rate helpful posts.

tszeliga1 · ‎02-08-2013

easy solution

no crypto pki trustpoint keyname

no crypto pki certificate chain keyname

reload

after reload ios create new pki

P.S.: please mark this thread as answered if you feel your query is resolved ;-)