Solved

Cannot Import Intermediate SSL Cert on Cisco Router

Posted on 2014-02-23
7
1,471 Views
Last Modified: 2014-03-21
We are having a problem installing an SSL Certificate from GeoTrust in our Cisco 1811 for VPN AnyConnect to use.  The Instructions seem about the same for Cisco router IOS and ASA but we are having problems installing the intermediate key.  All the documentation I find says to "just install the intermediate key first".  But I'm afraid I don't understand what that means, trying to apply the intermediate key seems to change nothing.

Here's the order we are trying using the following commands:
crypto ca trustpoint VPN-Trustpoint
enrollment terminal pem
crl optional
subject-name CN=vpn.ourdomain.com,OU=IT,O=OurCompany,C=US,ST=CA,L=OurCity
fqdn vpn.ourdomain.com
rsakeypair vpn-sslkey

exit
crypto ca enroll VPN-Trustpoint
---Generated the CSR ---

crypto ca authenticate VPN-Trustpoint
---Placed Root CA here with brackets---

crypto ca import VPN-Trustpoint certificate
---Pleaced Cert here with brackets---

Open in new window

                               

And get the following error:
% Failed to parse or verify imported certificate


In debug:
valid cert path not found (reason: 18) ../VIEW_ROOT/cisco.comp/pki_ssl/src/ca/provider/path/pkix/pkixpath.c


If I try the Intermediate key in place of either the CA or certificate I get the same error.  What is the proper order/commands?  Any thoughts or hints would be greatly appreciated!

Thanks,
Robert
0
Comment
Question by:Robert Davis
  • 4
  • 3
7 Comments
 
LVL 18

Expert Comment

by:Akinsd
ID: 39893200
Did you install the chain certificate? If yes remove it before trying the intermediate key.

Are you the CA or is that a 3rd party? If 3rd party, contact you vendor and verify the certificate. It looks like it is pointing to a path it can not find.

You can try using the ASDM if that will help
http://www.entrust.net/knowledge-base/technote.cfm?tn=8237
http://www.entrust.net/knowledge-base/technote.cfm?tn=8238
0
 
LVL 1

Author Comment

by:Robert Davis
ID: 39893367
The 3rd party is GeoTrust and their are two intermediate keys listed on https://knowledge.rapidssl.com/support/ssl-certificate-support/index?page=content&id=AR1548

So which do I put into the trust point, and how do I put the second into the same trustpoint before installing our certificate?

Thanks Akinsd,
Robert
0
 
LVL 18

Expert Comment

by:Akinsd
ID: 39893482
Here is a step by step instruction - both ASDM and CLI

http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/97856-asa-3rdpartyvendorcerts.html

The 3rd party is GeoTrust and their are two intermediate keys listed on
I don't quite understand the statement. You may need to contact GeoTrust to verify what you have. What you have on the link are just examples.

I hope this helps
0
VMware Disaster Recovery and Data Protection

In this expert guide, you’ll learn about the components of a Modern Data Center. You will use cases for the value-added capabilities of Veeam®, including combining backup and replication for VMware disaster recovery and using replication for data center migration.

 
LVL 1

Author Comment

by:Robert Davis
ID: 39893771
Thank you for the link, this is the guide I used but it does not cover the installation of two intermediate certificates.  GeoTrust requries both be installed, the ones on rapidssl.com are the current public intermediate certificates as well as the root CA.  Unfortunately the previous links provided are for the ASDM GUI, which don't' apply to Cisco router's Configuration Pro.  It appears the Cisco router GUI lacks a place to install certificates, so I was left with using crypto ca authenticate VPN-Trustpoint.

When I try running crypto ca authenticate VPN-Trustpoint twice, once with each intermediate certificate, I get an error saying the trustpont already has a ca.
0
 
LVL 18

Expert Comment

by:Akinsd
ID: 39894060
You can configure 2 trustpoints even in Cisco routers

See the configuration below.


http://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/27860-ios-enhanced-enrollment.html

crypto ca trustpoint caserver1
enrollment retry period 5
enrollment mode ra
enrollment url http://171.69.89.125:80/certsrv/mscep/mscep.dll
usage ike
serial-number
fqdn 2611-vpn.cisco.com
ip-address Ethernet0/0
password 7 1107160B12
subject-name OU=PARIS O=FRANCE
crl optional
rsakeypair ciscovpn
auto-enroll regenerate
!
crypto ca trustpoint caserver2
enrollment retry period 5
enrollment mode ra
enrollment url http://171.69.89.111:80/certsrv/mscep/mscep.dll
usage ike
serial-number
fqdn 2611-vpn.cisco.com
ip-address Ethernet0/0
password 7 130B181C0E
subject-name OU=ROME O=ITALY
rsakeypair tacvpn
auto-enroll regenerate
crypto ca certificate chain caserver1
0
 
LVL 1

Accepted Solution

by:
Robert Davis earned 0 total points
ID: 39933499
I ended up using the following order based on the digicert tutorial to complete the install.  The trick is to have an empty first trust point, which has the first intermediate cert, and a second trust point using the "chain-validation continue [FirstTrustpointName]" with the second intermediate certificate and the ssl cert.

crypto ca trustpoint VPN-Trustpoint
enrollment terminal pem
rsakeypair vpn-sslkey
exit

crypto ca trustpoint VPN-Trustpoint-2
enrollment terminal pem
crl optional
subject-name CN=vpn.org,OU=IT,O=Org,C=US,ST=NY,L=City
fqdn vpn..org
rsakeypair vpn-sslkey
chain-validation continue VPN-Trustpoint
exit

crypto ca enroll VPN-Trustpoint-2

crypto ca authenticate VPN-Trustpoint
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
quit

crypto ca authenticate VPN-Trustpoint-2
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
quit

crypto ca import VPN-Trustpoint-2 certificate
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
quit

webvpn gateway gateway_1
ssl trustpoint VPN-Trustpoint-2
end

Open in new window

0
 
LVL 1

Author Closing Comment

by:Robert Davis
ID: 39944764
Worked for intermediate certs
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
SNMP v3 Encryption of encoded messages 3 31
nmap scanner? 7 78
Simple Guest VLAN Help 17 36
Network Connection 5 34
Let’s list some of the technologies that enable smooth teleworking. 
If your business is like most, chances are you still need to maintain a fax infrastructure for your staff. It’s hard to believe that a communication technology that was thriving in the mid-80s could still be an essential part of your team’s modern I…
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now