FQDN

[networker101]

Hi,

Can I use an IP address for FQDN on the ASA? or will it have to be a domain name. The current SSL is self signed and it is used for webvpn.

Thanks

[Jennifer Halim]

Definitely can.

I have just quickly lab it, and here is the steps:

crypto key generate rsa label mykey modulus 1024

crypto ca trustpoint myTP2
enrollment self
fqdn none
subject-name cn=100.1.1.1
keypair mykey

crypto ca enroll myTP2

Here is the output for your reference:

ASA(config)# sh cry ca cert
Certificate
  Status: Available
  Certificate Serial Number: 31
  Certificate Usage: General Purpose
  Public Key Type: RSA (1024 bits)
  Issuer Name:
    cn=100.1.1.1
  Subject Name:
    cn=100.1.1.1
  Validity Date:
    start date: 01:45:50 UTC May 17 2010
    end   date: 01:45:50 UTC May 14 2020
  Associated Trustpoints: myTP2

Hope that helps.

[networker101]

Thanks for that, but when i submit it to Godaddy to retrieve the SSL certificate it does not issue it has the FQDN has an ip address.

Regards

Frank

[Jennifer Halim · Accepted solution]

Did you have "fqdn none" when you generate the CSR to GoDaddy? If you already have "fqdn none" under the trustpoint that you have

created for the GoDaddy certificate, then you would need to contact GoDaddy to issue you with certificate with only IP Address in the subject-name.

Please double check that you have "fqdn none" configured under the trustpoint.

[networker101]

ok thanks i will do.

One more thing if you dont mind, can you give me your spec of your lab? I am in the process of putting one together not sure on the hardware etc.

Thanks

[Jennifer Halim]

It's ASA 5510 with base license, running version 7.2.4.

[networker101]

Thanks