Hello
Interesting article (you have read it already )
D'Juan Tyson napisano:
For example, I am really blurry about what the following commands are accomplishing:crypto pki trustpoint my-trustpoint
enrollment selfsigned
serial-number
subject-name CN=firewallcx-certificate = = = > What is this line doing?
revocation-check crl
rsakeypair my-rsa-keys
The subject-name subcommand allows you to specify other options in the certificate.
For example, you can sets the fields:
C= (Country)
CA= (Certificate authority)
CN= (Common Name)
O= (Organization)
OU= (Organizational Unit)
ST= (State)
If the subject-name subcommand is not used, by default, the router Fully Qualified Domain Name (FQDN) is used.
For example:
ip hostname webvpn
ip domain-name company.com
the FQDN in the certificate will be: webvpn.company.com
P.S.
If https is already running on the router - it means that the self-signed certificate is created, because the router generates it automatically.
Or you can generate it now (enter the command: ip http secure-server)
You can use this certificate, read below article:
http://tekcert.com/blog/2011/08/05/configuring-clientless-ssl-vpn-webvpn-cisco-ios-routers
At section: "A key point to make here is that enabling http secure-server (https) forces the router to create a self-signed certificate if it hasn't already done so."
________________
Best regards,
MB
Hey DT,
I'm not sure if this is the problem.
Not enough information. Maybe this?
"Untrusted VPN Server Certificate!, AnyConnect cannot verify the VPN server: ........"
Server Certificates
A valid, trusted server certificate configured on the secure gateway provides an easy and safe VPN connection for the user.
AnyConnect on mobile devices provides improved security protection when accessing a secure gateway by blocking the VPN connection if the certificate presented by the secure gateway is invalid or untrusted, or both.
A new Block Untrusted Servers application setting determines how AnyConnect blocks connections if it cannot identify the secure gateway. This protection is ON by default; it can be turned OFF by the user, but this is not recommended.
AnyConnect uses the digital certificate received from the server to verify its identify. If the certificate is invalid (there is a certificate error due to an expired or invalid date, wrong key usage, or a name mismatch), or if it is untrusted (the certificate cannot be verified by a Certificate Authority), or both, the connection is blocked. A blocking message displays, and the user must choose how to proceed.
When Block Untrusted Servers is ON, a blocking Untrusted VPN Server notification alerts the user to this security threat. The user can choose:
•Keep Me Safe to terminate this connection and remain safe.
•When Block Untrusted Servers is OFF, a nonblocking Untrusted VPN Server notification alerts the user to this security threat. The user can choose to:
•
••
If the certificate that the user is viewing is valid but untrusted, the user can:
–
–
If the certificate is invalid, for any reason, the user can only return to the previous screen and choose Cancel or Continue.
Leaving the Block Untrusted Servers setting ON, having a valid, trusted server certificate configured on your secure gateway, and instructing your mobile users to always choose Keep Me Safe is the safest configuration for VPN connectivity to your network.
Try it, and reply.
Please, enter the full error message or attach example (screen) from the Internet.
________________
Best regards,
MB
Please rate all helpful posts
