Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What are the correct steps to configuring an ASA5505 to be its own CA without a Microsoft CA being available and giving users the ability to self-enroll?

Specifically, I would like our ASA to use certificates for both VPN and SSL connections and I've managed to configure the Local Certificate Authority via ASDM but I cannot figure out what the URL the ASA uses for users to download their certificates is.

Also, do you need separate key pairs for VPN and SSL? Can you use certificates for SSH connections to the ASA?

Thank you in advance.

share|improve this question
up vote 1 down vote accepted


This document may help:

ASA: Local CA Server configuration

share|improve this answer
Thank you. I did come across that document but for some reason I was getting a 404 error when trying to access the ASA through WebVPN. Then I realized that webvpn was not enabled on the outside interface. Would you happen to know the answer to the other questions? Thanks again! – Bourne Apr 6 '11 at 20:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.