Resolution
To enroll for a certificate from Verisign, obtain a root certificate from the CA, then Install the Digital Certificates on the VPN Concentrator
Once the root certificate is installed, you can request an enrollment by two ways
1) Manually
2) Simple Certificate Enrollment Protocol (SCEP).
Now send the enrollment request to the CA (Verisign). They will generate a certificate and then send that (identity certificate )to you.
When installing the certificate, it checks if it is from Verisign and looks through your list of root certificates to see if Verisign is trusted or not. It then verifies that Verisign is trusted or not and since you have the verisign root cert installed it will then see that verisign is indeed trusted so therefore the identity cert will be found to be from a trusted source.
For more information,refer to the section of Configuring the Cisco VPN 3000 Concentrator 4.0.x to Get a Digital Certificate.
