ASDM java warning after java update

[Brian Korfitz Miehs]

Hi

I am seening this when i launch ASDM and some of my customeres are voiceing thier concerns.

          

Any eta. on a fix ?

Dont say downgrade java

[Marvin Rhoads]

What Java and ASDM are you seeing this with?

I'm running Java 7 Update 40 and do not get that message with the current ASDM 7.1(4).

[Brian Korfitz Miehs]

The error is there with both Java 1.7.0_25 and 1.7.0_45.

ASDM version 7.1(3) and 7.1(4(.

I get this error in most java app's atm. and the reason is listed on www.java.com so this isnt a uniqe error at all. That why i'm asiking when cisco going to fix ASDM.

http://java.com/en/download/help/appsecuritydialogs.xml#selfsigned

[Marvin Rhoads]

Well you'd have to open a TAC case t get an official answer on Cisco's plans to fix ASDM to accommodate Oracle changing Java independently.

Oddly even after updating my Java to 1.7 update 45, I still don't get the warning message.

[Brian Korfitz Miehs]

True but i was hoping one of the Cisco guys on this forum would know the answer.

Since you dont get the error the java applet must have a cert. your pc trust.

[Marvin Rhoads · Accepted solution]

Cisco has posted an official recommendation: "Ignore the warning."

https://tools.cisco.com/bugsearch/bug/CSCul15841

[schuh]

Since Oracle seems to know, that companies like Cisco tend to not solve these things in a few months due to high number of application needing changes, there is also an Oracle announcement of Nov. 25, 2013, that the next Java will have an exception list

    https://blogs.oracle.com/java-platform-group/entry/upcoming_exception_site_list_in

The user can (have to) add those URLs, where applications are not yet updated.

All this is only relevant, if ASDM is started via Java Web-Start. If the ADSM-IDM.Launcher is installed locally, these security restrictions are not relevant.

Far more important than these changes are the changes, Oracle has announced for trust handling of certificates. The user will no longer be able to interactively trust self-signed certificates. Or to temporarily ignore any other certificate warnings based on for example name mismatch between accessed URL and certificate's subject name.

Those who still use devices with self-signed certificates need to prepare for those changes. Cisco will not be able to help here much, I guess (besides promoting Cisco's own PKI solutions)