Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

VPN 3000 concentrator and invalid certificates

I am troubleshooting certificate issues on our VPN 3000 series concentrator:

I have two laptops set up with the Cisco VPN client, both using the same VPN certificate.

One laptop can log in successfully to the VPN, the other attempts to connect but fails before the username/password prompt even appears.

The following entry is found on the VPN concentrator for the failed connection:

18275 10/08/2009 09:46:53.150 SEV=5 IKE/79 RPT=3174

Group [Contractors]

Validation of certificate successful

(CN=A. Marshall, SN=1FCB63DA0000000000AB)

18277 10/08/2009 09:46:53.290 SEV=5 IKE/68 RPT=130

Group [Contractors]

Received non-routine Notify message: Invalid certificate (20)

18279 10/08/2009 09:46:53.290 SEV=5 IKE/50 RPT=2083

Group [Contractors]

Connection terminated for peer .

Reason: Peer Terminate, Administratively Disconnected.

Remote Proxy N/A, Local Proxy N/A

Can anyone point me in the right direction for troubleshooting this?

Cisco Employee

Re: VPN 3000 concentrator and invalid certificates

Does this laptop that fails have the root and Id valid?

Cisco Employee

Re: VPN 3000 concentrator and invalid certificates

Can you get the logs from the client too and post them here

New Member

Re: VPN 3000 concentrator and invalid certificates

This was traced finally to the fact that the root and issuing authority certificates for our organisation were not being exported with the client certificate, so the client was rejecting the VPN concentrator's certificate.