ASDM-IDM Launcher asking for certificate when logging in

[Shaun Michelson]

When starting the ASDM-IDM Launcher, I'm being asked to provide a certificate before logging in:

The certificates it lists for me to choose from were issued by an old Active Directory Enterprise CA that is no longer in service. The ASDM launcher started prompting me for a certificate after I recently uploaded the new CA certificate that replaced the old.

We use certificates for remote VPN connectivity and that's it. I don't need the ASA to prompt for certificates when logging in to manage it. What's the best way to correct this? Should I delete the CA Certificate and associated Truspoint using the ASDM?

[Marvin Rhoads]

Can you provide the output of "show run http"? That will show us the authentication method specified in the configuration for ASDM (which runs over https).

We would normally look for something like:

   http authentication local

or

   http authentication aaa local

(and in the latter case would also check our aaa authentication method).

[Shaun Michelson]

show run http gives the following:

http server enable
http xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx inside
http redirect outside 80

Doesn't give anything about authentication.

I do have the following line in the config:

aaa authentication ssh console LOCAL

[Marvin Rhoads · Accepted solution]

I'm not sure why it's prompting for certificate-based authentication.

In any case, you might try adding:

     aaa authentication http console LOCAL

...to the config.

[Shaun Michelson]

I opened a ticket with Cisco support and the technician had me run a "clear ssl" command, which seems to have fixed things.