It’s never good practice to have your users get used to seeing “Certificate Invalid” errors on secure sites. I know a lot of IT departments that train their users to just click past the errors. What happens when you enable a Man in the Middle attack? Cain and Abel anyone?<\/p>\n
So after we had our load balanced ASA5510’s setup, we purchased some licenses for SSLVPN Users. Unfortunately that means the site must be secured AND have a certificate. The self-signed cert is only good for testing. Production requires an authenticated certificate from a globally trusted CA. For our internal-facing sites we utilize GoDaddy (cheap certs).<\/p>\n
Create the CSR:
\nASDM for Cisco login
\nConfiguration, then Certificate Management, followed by Identity Certificates
\nClick Add
\nClick the radio button Add a new identity certificate
\nClick New… for a new key pair – I generally name it godaddy12 (vendor+year) and make it 2048 bit
\nIn the Certificate Subject DN, Add the CN (vpn.domain.tld MUST BE FQDN), the OU, the O, the C, the St, and the L as appropriate
\nClick on the advanced button and make sure the FQDN is the same as the CN you entered before (vpn.domain.tld)
\nNow click on Add Certificate
\nBrowse to where you want to save your CSR – I save it as ASA5510_12.csr.txt<\/p>\n
Godaddy Cert
\nPurchase the cert and download the certificate using the “other” category. That way you get the CA cert (and intermediary) along with your identity certificate.
\nLog into your ADSM
\nSelect Configuration
\nSelect Device Management
\nExpand Certificate Management
\nSelect CA Certificates
\nClick Add, select the gd_bundle.crt
\nThen select Identity Certificates
\nClick on your CSR Request and click the Install button
\nSelect your SITENAME.crt<\/p>\n
Now we need to apply these certificates to the SSL Site!
\nUnder Configuration, Device Management still
\nExpand Advanced
\nSelect SSL Settings
\nClick on the interface where your SSLVPN terminates (in my case it was outside)
\nEdit this interface
\nSelect the Primary Enrolled Certificate and Load Balancing Enrolled Certificate (if applicable)
\nApply the settings<\/p>\n
Test your https:\/\/vpnsite
\nIf everything tests OK, save the configuration<\/p>\n","protected":false},"excerpt":{"rendered":"
It’s never good practice to have your users get used to seeing “Certificate Invalid” errors on secure sites. I know a lot of IT departments that train their users to just click past the errors. What happens when you enable a Man in the Middle attack? Cain and Abel anyone? So after we had our … Continue reading Install SSL Certificate on Cisco ASA 5510 SSL VPN<\/span>