One more issue:

you can setup websites from the internet that can be used from the outside after logging on from the Cisco web interface, but without actually setting up the VPN.

This is a nice feature. It works fine for non-secure (http) websites. However, we also a https site on the inside with a self-signed certificate (iomega storage device). This device cannot be accessed this way.

So two questions remain (I've given up on the Mac issue):

* how do we install a new certificate for the SR520 from the CCA

* how do we get https websites to work

We still have been unable to figure this out.

Anybody?

Working on this.  Let me see if this can be done in CCA currently or not.  If not, I will post something on how to add the cert manually.  Once added manually, this should work without issue.  What version of IOS are you running?

There is an enhancement in to disable certificate verification of the sites that are going through this.

CSCsy05978:  ENH: IOS PKI should have a option to disable certificate validation

Let me see what I can do on this.

SR520#show version;

Cisco IOS Software, SR520 Software (SR520-ADVIPSERVICESK9-M), Version 12.4(24)T, RELEASE SOFTWARE (fc1)

Here is what you can try.

Router(config)# crypto ca trustpoint

Router(config)# crypto ca authenticate

The router will then prompt you to paste in the CA certificate associated  with the HTTPS site.  This is going to be the CA cert in base64 (ascii)  format.

Let me know if that works for you.