Public Key Pinning with the AnyConnect Client

[Sleepw4lker]

Hello everyone,

does anybody know if there's the possibility to pin the public key of the CA that signed the identity certificate on the ASA, so that if a MITM attack would occur (which would probably change the public key of the cert visible to AnyConnect), the connection would be impossible.

I noticed that there's a field for a "CA thumbprint" under the Server List in the profile manager. Is this what I'm searching for?

Thanks in advance and kind regards

[Jan Rolny]

Hi,

i think in case MITM will occur so Anyconnect client will warn user that certificate does not match.

I am not sure about "CA thumbprint " but there is another feature on client side called FIPS mode it would meet your requirements.

Try this document:

http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect25/administration/guide/ac04localpolicy.html

Best regards,

Jan