Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Can somebody give me a pathway (or link to the documentation / how to) to implement two-factor authentication (LDAP password + certificate) on Cisco ASA for RemoteVPN (with Anyconnect client)?

Currently our Cisco ASA (5505, 8.4.3) is configured for password authentication using OpenLDAP server. We use RemoteVPN with AnyConnect Client (SSL VPN). And I would like to add certificates into authentication/authorisation process. I don't want to use any external Certificate Authority. I even probably don't need personal certificates for every user.

What I need is just to check if user has a valid certificate before/after/during authentication/authorisation on LDAP with password.

To be honest, now I don't clearly understand how it should work.

1) First of all, I don't understand, where should it be configured on Cisco ASA.

Should I just enable both certificate and aaa authentication "(config-tunnel-webvpn)# authentication aaa certificate" for my tunnel group through my OpenLDAP server? How will it work then? Does OpenLDAP support certificate validation?

Or I need to use secondary authentication to add certificates? Do I need then to configure some server then for secondary authentication?

Or I need to make any other configuration, like CA authority? How then CA authority can get usernames from OpenLDAP? Or can I just make one certificate for all users (such a security level is totally enough for my company)?

2) How the certificate validation process should work? How Cisco ASA will validate the certificate? Is it something like openssl private/public keys or not? Can I set up Local CA Authority on ASA, but still get all users from OpenLDAP? Will it just extract username from the certificate or it will somehow use the certificate itself for authentication?

Thank You very much in advance.

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.