Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Installing certificate for SSL vpn in ASA 5510

Dear All,

We have purchased "True BusinessID certificate" from Geotrust for our SSL VPN.  Geotrust issued 2 certificates such as Web Server CERTIFICATE & INTERMEDIATE CA.

SSL vpn is being configured in Cisco ASA 5510 software version 7.2(3). Now we could successfully install INTERMEDIATE CA successfully to ASA but Web Server CERTIFICATE cannot install and gives the following error

*Failed to parse or verify imported certificate*

We followed this link to install the certificates

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00808a61cd.shtml

We contacted geotrust regarding this errror and they suggest to install GeoTrust Root along with the Primary & Secondary Intermediate CA certificates for True BusinessID certificate.

https://knowledge.geotrust.com/support/knowledge-base/index?page=content&id=SO19785&actp=AGENT_REFERAL

1. Can anyone please help us to install Root along with the Primary & Secondary Intermediate CA certificates on our Cisco ASA 5510 version 7.2(3)  . is there any proper way to install certificate i mean ROOT--intermediate--identify ?

2. Have we seleted the exact SSL certificate from Geotrust for our SSL VPN? is there any other certificate we should get it from Geotrust? please shed some light on this.

Thanks in advance

1 ACCEPTED SOLUTION

Accepted Solutions
New Member

Installing certificate for SSL vpn in ASA 5510

Hi,

Please see the following from the Cisco site,

This error can occur when you install the identity certificate and do not have the correct intermediate or root CA certificate authenticated with the associated trustpoint. You must remove and reauthenticate with the correct intermediate or root CA certificate. Contact your 3rd party vendor in order to verify that you received the correct CA certificate.

Could you check the following:

show crypto ca trustpoint


show crypto ca certificate


show crypto ca crls


show crypto key mypubkey rsa


    Regrads Craig

    7 REPLIES
    New Member

    Installing certificate for SSL vpn in ASA 5510

    Dear All,

    Can anyone please respond?

    New Member

    Installing certificate for SSL vpn in ASA 5510

    Can anyone kindly response to this?

    New Member

    Installing certificate for SSL vpn in ASA 5510

    Hi,

    Please see the following from the Cisco site,

    This error can occur when you install the identity certificate and do not have the correct intermediate or root CA certificate authenticated with the associated trustpoint. You must remove and reauthenticate with the correct intermediate or root CA certificate. Contact your 3rd party vendor in order to verify that you received the correct CA certificate.

    Could you check the following:

    show crypto ca trustpoint


    show crypto ca certificate


    show crypto ca crls


    show crypto key mypubkey rsa


      Regrads Craig

      New Member

      Installing certificate for SSL vpn in ASA 5510

      Thanks for your response.

      Kindly find below the command out put for your kind persual.

      ASA-5510-1# sh crypto ca trustpoints

      Trustpoint my.geotrust.trustpoint:
          Subject Name:
          cn=GeoTrust Global CA
          o=GeoTrust Inc.
          c=US
                Serial Number: 12bbe6
          Certificate configured.

      ====================================

      ASA-5510-1#
      ASA-5510-1# show crypto ca certificate
      CA Certificate
        Status: Available
        Certificate Serial Number: 12bbe6
        Certificate Usage: General Purpose
        Public Key Type: RSA (2048 bits)
        Issuer Name:
          ou=Equifax Secure Certificate Authority
          o=Equifax
          c=US
        Subject Name:
          cn=GeoTrust Global CA
          o=GeoTrust Inc.
          c=US
        CRL Distribution Points:
          [1]  http://crl.geotrust.com/crls/secureca.crl
        Validity Date:
          start date: 08:00:00 UAE May 21 2002
          end   date: 08:00:00 UAE Aug 21 2018
        Associated Trustpoints: my.geotrust.trustpoint

      ============================================

      ASA-5510-1# show crypto ca crls
      No CRLs are currently cached.


      =============================================================
      ASA-5510-1# show crypto key mypubkey rsa
      Key pair was generated at: 06:52:10 UAE May 3 2010
      Key name:
      Usage: General Purpose Key
      Modulus Size (bits): 1024
      Key Data:

        30819f30 0d06092a 864886f7 0d010101 05000381 8d003081 89028181 00dfc4d5
        b7cf8e24 c2760aa9 37a5d40f 179903d2 b3d51357 5b219bee 3270fb1c 48cd16e1
        9004d5c6 ec86bdb7 ebc71e8c 455d05eb 312db6f5 aef97aef 8bf23427 04ca4959
        803cc460 852f49cc 776f6d98 57baec74 5ad1acbc 3cc279ac 52de5869 3dab1f37
        3c62f475 6ba808eb 0e4e0499 71a8f31d cf72f72f 69b5bff9 ca33c032 19020301 0001
      Key pair was generated at: 17:36:40 UAE Apr 19 2012
      Key name: my.geotrust.key
      Usage: General Purpose Key
      Modulus Size (bits): 2048
      Key Data:

        30820122 300d0609 2a864886 f70d0101 01050003 82010f00 3082010a 02820101
        008e8e84 b1adf90f d52d1d89 040b3ce7 3fe07c9c 3cb53ee0 9d71957d b26697f4
        7df72cc3 76413697 cc25014b ee45ad2b 07734549 58e489e6 d826e853 784e6e23
        abcbdade 6cdd674c 6160a9f5 d01a80ec 67c9677b 3aa38361 7e7862d0 34ce1e77
        759b6f32 4069fe95 bb3f40b0 3c9670b5 3401d70e 4d6b43d6 42caa2fa c1d2cf91
        ad8bb4e6 8b6b1cfa 6be5b061 efbb6b30 6ac1e240 ec5241e0 22a5a8b8 27fcce01
        2939037d e993cca1 21fa4e02 380820a1 079273bb 43d9ebb4 a03908d9 d43426b1
        e6fd3c75 40c95cd2 d52f176d 5006cc1b 588609ec f2135451 b6101a3d f4f24ec7
        6160f75a 82738b99 c7499675 cf0a4183 c6a4fc49 75fc9709 87f94427 04ceb4ef
        6d020301 0001
      Key pair was generated at: 23:23:42 UAE Apr 22 2012
      Key name: .server
      Usage: Encryption Key
      Modulus Size (bits): 768
      Key Data:

        307c300d 06092a86 4886f70d 01010105 00036b00 30680261 00aaca61 b80c8cf2
        01b74427 4ec8e7a6 50774d04 3506aa46 87d5740b bd842a34 25789e1e f544c14b
        76c1f651 a9f3a44e f6dc5747 851895c1 633e944d 538c55bd f72f4181 3632688b
        25407ea6 01a12c59 67b89bf1 befcd92f 4ba98fa3 16b6070b 35020301 0001
      ASA-5510-1#

      Debugg while importing identity certificate
      =====================================
      ERROR: Failed to parse or verify imported certificate

      ASA-5510-1(config)#
      CRYPTO_PKI: status = 1795: failed to verify or insert the cert into storage

      New Member

      Installing certificate for SSL vpn in ASA 5510

      Can anyone please respond

      Hall of Fame Super Silver

      Installing certificate for SSL vpn in ASA 5510

      The Geotrust article in your original post is pretty explicit about how to install the necessary certificates. Just follow that procedure.

      New Member

      Installing certificate for SSL vpn in ASA 5510

      Hi All,

      The issue i was getting the error while importing certificate to ASA 5510 7.2(3) was due to identifty certificate issued from CA. there were some fields were empty on the subject tab inside the certificate.

      To isolate the issue we had to revoke the old certificate and generate a new one. 

      In Geotrust there is no such procedure to install certificte in ASA 5510 software version 7.2(3)  .. they have procedure for 8.0 which is tottaly different fron 7.2

      Thanks to all your response.

      5840
      Views
      5
      Helpful
      7
      Replies