i am having trouble trying to request certificates on a pix 515 (Cisco PIX Firewall Version 6.3(3))
The VPN and certificate side was working before but started getting problems due to the certificate becoming invalid.To cut the long story short we had to reconfigure the pix wich has solved some issues but am not getting any where when trying to do a authenticate as the folllowing error comes up: % No CA root cert exists. Use "ca authenticate".
no matter how many times i do a CA authenticate, this error still appears.
the CA identity is ca identity my-ca CA 10.10.1.10://certsrv/mscep/mscep.dll and if i put in 10.10.1.10//certsrv/mscep/mscep.dll in a url , i end up with the scep welcome page with the CA's certificate fingerprint.
Example of steps taken with debug crypto on.
pix515(config)# ca authenticate my-ca
pix515(config)# ca enroll my-ca 123456
% No CA root cert exists. Use "ca authenticate"
pix515(config)# debug crypto ca
pix515(config)# ca authenticate my-ca
CI thread sleeps!
Crypto CA thread wakes up!
CRYPTO_PKI: http connection opened
CRYPTO_PKI: WARNING: A certificate chain could not be constructed while selecting certificate status
CRYPTO_PKI: WARNING: Invalid signature on certificate or CRL while checking certificate using self signed certificate
CRYPTO_PKI: WARNING: Certificate, private key or CRL was not found while verifying cert in message by issuer self-signed cert
CRYPTO_PKI: WARNING: A certificate chain could not be constructed while selecting certificate status
CRYPTO_PKI: WARNING: Invalid signature on certificate or CRL while checking certificate using self signed certificate
CRYPTO_PKI: WARNING: Certificate, private key or CRL was not found while verifying cert in message by issuer self-signed cert
CRYPTO_PKI: WARNING: A certificate chain could not be constructed while selecting certificate status
CRYPTO_PKI: WARNING: Invalid signature on certificate or CRL while checking certificate using self signed certificate
CRYPTO_PKI: WARNING: Certificate, private key or CRL was not found while verifying cert in message by issuer self-signed cert
CRYPTO_PKI: WARNING: A certificate chain could not be constructed while selecting certificate status
pix515(config)#
CRYPTO_PKI: WARNING: Invalid signature on certificate or CRL while checking certificate using self signed certificate
CRYPTO_PKI: WARNING: Certificate, private key or CRL was not found while verifying cert in message by issuer self-signed cert
CRYPTO_PKI: status = 324: failed to verify
CRYPTO_PKI: transaction GetCACert completed
Crypto CA thread sleeps!
CI thread wakes up!
pix515(config)# pix515(config)# ca enroll vpn-ca 123456
% No CA root cert exists. Use "ca authenticate"
