0

Our Offline Root CA server was setup prior to my joining the company and has com as the country code which is invalid for several things that I'm needing to do...primarily to get clients to stop complaining about the cert when connecting to our ASA for vpn.

Where do I go to update what the Root CA has for it's values without breaking our current setup?

Additionally, is there a way to do this that keeps all the currently issued certs valid, but would enable all the new ones that are issued to be valid?

Improve this question
4
  • 1
    As far as I know, the Root CA can have whatever it likes...the stuff you sign (CSRs) has this information and can be set by server.
    – Nathan C
    Apr 11, 2014 at 14:16
  • To add to Nathan's comment, it sounds like all you need to do is issue a new certificate with the proper SAN (subject alternative name) for your ASA(s).
    – HopelessN00b
    Apr 11, 2014 at 14:21
  • The issue based on my Cisco TAC case was the country listed by the ROOT CA and subsequently the Intermediate CAs is invalid because it's three letters instead of two. The ASA simply can't handle this for whatever reason.
    – Jared
    Apr 11, 2014 at 14:26
  • @Jared Oh. Ouch. That sounds like you need to, at a minimum, issue a new root certificate. That's not gonna be fun. I'm not 100% on that, though, so... I'll wait for someone who is to come along and say it.
    – HopelessN00b
    Apr 11, 2014 at 14:32

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .