Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to purchase and install a SSL certificate on my Cisco ASA firewall. This will allow my VPN users to connect to my ASA without receiving the certificate error from the untrusted self assigned SSL certificate that is currently on the ASA.

I had good experiences with the SSL certificates that GoDaddy sells. However, I'm concerned about using them. On my web servers I have to also install GoDaddy's "intermediate certificate bundle". On the ASA I do not think that I will be able to preform anything like this. I do not fully understand what the "intermediate certificate bundle" does, but obviously it's important.

So my question is can I use a GoDaddy SSL certificate on an ASA without my users getting any type of warning or error about connecting to a site that using an untrusted SSL certificate. I need this to be as simple as possible for my end users and warning messages are always scary :)

Thanks!

share|improve this question
add comment

3 Answers

up vote 3 down vote accepted

I have a GoDaddy (standard, not deluxe) wildcard certificate that I use on my ASA 5510 for ASDM access. ASDM says that "SSL parameters affect both ASDM and SSL VPN access," so if it works for me, it should for you and SSL VPNs.

I did have problems importing a .pem version of my certificate chain. Using a *.pfx (like IIS uses) worked fine.

I grabbed gd_intermediate.crt from https://certs.godaddy.com/Repository.go

In ASDM, Configuration, Device Management, Certificate Management, CA Certificates; click Add, don't change any defaults, install from file, locate the gd_intermediate.crt file.

I also tried loading gd_bundle.crt which some of our certs use and that failed, but since gd_intermediate.crt worked and that's what my wildcard uses, I didn't test any more.

Once the intermediate cert is loaded, go to Identity Certificates (right below CA Certificates) and do something similar (Add, import from file, chose the .pfx file, and enter the password for the .pfx.

Now that the cert is successfully installed, set which interfaces it will be used on. That's under Device Management, Advanced, SSL Settings. Click the interface (probably outside), click Edit, and choose the Trustpoint name of the certificate you added in the last step. Click OK, Apply, and try going to your https://vpn.url and see if it loads the right cert.

share|improve this answer
    
Thanks for the step by step process. Between this and the steps at the www.globalsign.com site that cwrea provided this was a piece of cake, and I'm not getting any certificate errors. –  Richard West Jun 29 '09 at 18:54
    
What type of certificate did you import? Were you able to get a .pem to import OK or did you use a pfx/something else? –  Dave Jun 29 '09 at 21:43
add comment

The intermediate certificate authority links your certificate back to a trusted root certification authority. It's an important link in the chain of trust.

Wikipedia has a brief article on Intermediate certificate authorities. There's also a good description here. Note that a chained certificate and intermediate certificate typically refer to the same thing.

Anyway, I think you should be able to use such a certificate with your device... I found the following instructions via Google. It's a page at another intermediate certificate authority which walks through installing their intermediate certificate on an ASA device prior to installing the SSL certificate they would issue: Install your Certificates in Cisco ASA 5500 SSL VPN/Firewall.

share|improve this answer
    
+1 for the very helpful link to www.globalsign.com web site. They have published a great step by step process. –  Richard West Jun 29 '09 at 18:52
add comment

Step by step guide to install Godaddy.com wild card certificate on Cisco ASA 5500 series boxes.

  1. Download intermediate certificate from https://certs.godaddy.com/anonymous/repository.seam.

  2. Goto https://www.sslshopper.com/ssl-converter.html and convert your .cer file into .pfx( Pkcs12 format) by inputing urdomain.cer & intermedicate.cer & private key (consider you have downloaded your private keys and certificates ie. *.urdomain.com) from gogaddy.com

  3. After you create .pfx file, In ASDM, Configuration, Device Management, Certificate Management, CA Certificates; click Add, don't change any defaults, install from file, locate the gd_intermediate.crt file. Once the intermediate cert is loaded, go to Identity Certificates (right below CA Certificates) and do something similar (Add, import from file, chose the .pfx file, and enter the password for the .pfx.

That's it and apply on the outside interface to use this certificate.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.