Cisco identity certificates

Similar Questions

• Profile Manager - MDM identity certificate

  Hello

  I would like to know what exactly is the "certificate of identity MDM? I find in my managed devices (SETTINGS-> General-> management-> remote management-> details-> (identity device certificates)). It is issued by Mac OS x OpenDirectory intermediate CA.

  I don't use signed code profiles (I read it is necessary to re-register device after expiry of cert).

  I use current Apple configurator to connect to the Profile Manager. More high certificate is valid for one year from date of registration.

  I would like to know it is possible to create more than a year instead of this certificate, and what I need to do before the expiry of this certificate to be able to update all of my devices in the Profile Manager without taking devices in my hand?

  I have approximately 50 iphones (unattended) related to my Profile Manager. Now, I want to connect another 50 iPads, this time as devices supervised.

  But I'm afraid what happens when the certificate expires, want to avoid this or at least to know what (and when) I need to do to avoid losing touch with my Profile Manager.

  Kind regards

  Kacper

  While it is possible to create your own certificate for sustainable computer server any longer, and your own code signing certificate last longer, it is not possible to change the length of time for the certificate of Push Notifications generated Apple is also necessary for an MDM solution.

  So you go without worrying about being stuck at a certificate that must be renewed annually and that you have to do before you run it really means more as every 11 months.

• Question ISE Cisco router certificate

  Hello

  I'm looking to get to the how to guides or examples of configuration on how ISE NHPS can be used as an intermediate CA (certification authority root in Enterprise Microsoft CA). Routers / Firewalls ASA automated certificate request to LSE which can issue the certificate as intermediate CA, purpose of these certificates to routers / firewall can use for configuration of the IPSec VPN.

  Thank you very much

  Rakesh

  Hello

  Here's the Cisco documentation:

  http://www.Cisco.com/c/en/us/TD/docs/security/ISE/2-0/admin_guide/b_ise _...

  It's very simple to set as an intermediary ca ise. ISE will use CEP Protocol to distribute certificates. Wait paragraph ISE CA issues certificates user VPN ASA.

  In a few words, after importing CA root and when you enable ise as a ca server, you will generate a csr from ISE. generate Windows intermediate certificate for ISE from this REA. That generated while bound this certificate to CSR in ISE.

  That's all.

  Don't worry, the steps are described very well in the ISE.

  There is a great video, I always recommend to newbies, labminutes; who do an outstanding job: http://www.labminutes.com/sec0187_ise_13_internal_certificate_authority _...

  What you need to know, is that you will not be able to create specific model to the LSE, as you did on Windows.

  PS: If this solves your problem do not forget to note and correct mark them as answer

  Thank you

• [Cisco AnyConnect] Certificate on RADIUS authentication

  Hello

  I use authentication and LDAP authorization certificates and it works fine.

  Now, I want to centralize authentication and authorization on the server RADIUS (Cisco ACS in my case)

  In the connection profile, we have 3 authentication methods:

  • AAA: I can choose RADIUS server group or LDAP--> the user is prompted to enter the username/password credentials
  • Certificate: I can't choose AAA server...--> user group will have to provide the certificate
  • Both: I choose the RADIUS or LDAP--> the user is prompted for username/password credentials and the user must provide the certificate

  If I choose the certificate authentication methods, I can't delegate the authentication and authorization of RADIUS server.

  Is there a solution to delegate the authentication of the certificate to the RADIUS?

  I have different authorization for each VPN connection profile rules

  ASA can send a VPN connection profile to the RADIUS? (in the RADIUS attribute...)

  Thanks for your help,

  Patrick

  Patrick,

  The essential in deployments using WLC is begging on client can talk to EAP (including EAP - TLS) so the AAA server can authenticate the certificate.

  In the case of Anyconnect, or old IPsec client there is no way to send the full cert to server AAA (not implemented/redundant from the point of view of the customer, or not in the standard).

  IOS also gives you a possibility to make calls for authorization of PKI:

  http://www.Cisco.com/en/us/docs/iOS-XML/iOS/sec_conn_pki/configuration/15-2mt/sec-cfg-auth-Rev-cert.html

  AFAIR is no similar mechanism on the SAA.

  M.

• ASA5505 using false identity certificate

  I have recently updated our firmware 8.4 ASA. (7) 3 to 9.0. (4) 24 and noticed later my oriented web interface (for SSL vpn remote access) suddenly used a self-signed certificate. When I look at identity by using ASDM certificates, the one listed certificate is the one I installed GoDaddy (and one that he should use - see screenshot). Anyone know what I can do to get back to my GoDaddy cert?

  You have probably lost the award of the certificate of the interface:

  ssl trust-point ASDM_TrustPoint3 outside

• Identity certificate replacing ASA5520 Anyconnect

  I hope someone can give me a quick answer to my query, we currently have an asa remote access using Anyconnect with self-signed certificate facility and several users in the database of certificate that we use for the radius and certificate authentication.

  I want to buy and get a signed certificate of trust CA (such as Verisign), and replace the current free signed certs.

  My question is should I reset the current ASA CA server and replace the certificate user database? That is to say to start over.

  No, you don't have to start from scratch. It is common to have the ASA-identity-CERT to a public certification authority, but user certificates are a private certification authority. With your change, get you exactly this scenario.

  --
  Don't stop once you have upgraded your network! Improve the world by lending money to low-income workers:
  http://www.Kiva.org/invitedBy/karsteni

• OpenSSL with 'Cisco VCS Certificate Creation and use - deployment guide. "

  Hi team,

  To prevent users to log on with the VCS Highway, we want to use OpenSSL (version: 1.0.1p 9 julio 2015), but I am facing the following problem:

  1 - I can't implement the command "touch index.txt".

  2 - I can´t implement the command "openssl genrsa-aes256-out private/cakey.pem 4096"; and when I apply these commands I get "OpenSSL is not recognized.

  I did all the steps that says "VCS certificate creation and use Cisco".

  What could be the matter?

  Thanks for your advice.

  Kind regards

  Bill

  Already explained why touch does not, simply create the .txt through windows command file.

• New engine Service Cisco Identity

  Does anyone know if the Cisco ISE not GANYMEDE?

  Hello

  Nope. It's pure RADIUS.

  I hope this helps.

  Kind regards

  Anisha

  P.S.: Please mark this thread as answered if you feel that your query is resolved. Note the useful messages.

• Renew the certificate of identity on Cisco ASA 5505, do I have to renew all user certificates?

  n00b questions.

  I have to renew my SSL certificate of identity soon on my Cisco ASA 5505.  I'll have to renew all my certificates for client on their devices, so they can establish a vpn tunnel?

  Hi dsartoros,

  If you encounter a self signed (generated locally) identity certificate renewed, then you will need to download this certificate on the clients so that they can connect without getting "untrusted server certificate error".

  If you renew a certificate issued by a 3rd party CA (sending of CSR to CA) and certificate, then you will not need to make any changes on the client as they already trust the certification authority that issues the certificate first root.

  Kind regards
  Dinesh Moudgil

  PS Please rate helpful messages.

• Renewal of certificates Cisco ISE Admin and EAP

  Hi on board,

  Maybe I'm asking a rather stupid question here, but anyway :)

  Currently, I think about how renew a certificate admin/EAP on a node of the ISE and the effect on the endpoint authentication.

  Here's the thing that I do when I install initially an ISE node

  1.) creation of CSR on ISE (PAN) - CN = $FQDN$ and SAN = 'name of FQDN as well. "

  2.) sign CSR and certificate of bind on the ISE node - done

  Now, after 10 months or two (if the certificate is valid for one year) I want to renew the certificate of admin/EAP ISE.

  Creation of CSR: I can't use the $FQDN$ like CN, because there is still the current certificate (CN must be unique in the store, right?)

  So what to do now? I really need to create a temporary SSC and make the admin/EAP certificate, remove the current certificate, and then create a new CSR? There must be a way better and more important to do nondisruptive.

  How you guys do this in your deployments?

  Thanks again in advance, and sorry if this is a silly question.

  Johannes

  You can install a new certificate on the ISE until he's active, Cisco recommends to install the new certificate before the expiry of the old certificate. This period of overlap between the former certificate expiration date and the new certificate start date gives you time to renew certificates and to plan their installation with little or no downtime. Once the new certificate enters its valid date range, select the EAP or HTTPS protocol. Remember, if you turn on HTTPS, there will be a restart of the service

  Renewal of certificate on Cisco Identity Services Engine Configuration Guide

  http://www.Cisco.com/c/en/us/support/docs/security/identity-Services-engine/116977-TechNote-ISE-CERT-00.html

• Cisco ASA 5505 and comodo SSL certificate

  Hey all,.

  I'm having a problem with setting up the piece of Certificate SSL of Cisco AnyConnect VPN. I bought the certificate and installed it via the ASDM under Configuration > VPN remote access > Certificate Management > identity certificates. I also placed the piece of 2 CA under the CA certificates. I have http redirect to https and under my browser, it is green.

  Once the AnyConnect client installs and automatically connect I get no error or anything. The minute I disconnect and try to reconnect again, I get the "VPN Server untrusted certificates! ' which is not true because the connection information to be https://vpn.mydomain.com and the SSL certificate is configured as vpn.mydomain.com.

  On that note, it lists the IP address instead of the vpn.mydomain.com as the unreliable piece of this. Now of course I don't have the IP as part of the SSL-cert, just the web address. On the side of the web, I have a record A Setup to go from vpn.mydomain.com to the IP address of the Cisco ASA.

  What I'm missing here? I can post config if anyone needs.

  (My Version of the Software ASA is 9.0 (2) and ASDM Version 7.1 (2))

  Yes that's correct. technically, it will take you to EKU as keys to authenticate server who was a little forced in version 3.1. But eventually, he was taken away. If you get no error using the browser and ot only comes with the anyconnect client. Most likely, you do not have to configured values. I can confirm that if you can share the fqdn with me also, you can try the upgrade and check it out.

  Thank you

  Bad Boy

• Cisco ISE (Identity Services Engine) - seeds SGA device?

  Hello

  We have a LAB with Cisco ISE, certificates and list DACL. Everything works fine with the 1.1.1 version but now we want to use the functionality of CMS - SGT instead of the ACL and we found that we need seed for this device and the only device that takes in charge the Nexus 7000 is. Is this true? What is the only way that we can use LMS - SGT? Are there plans that any other device will be used to seed device?

  BR, Marko

  The device of seed set as first device that communicates with the ISE. It must be a link.

  http://www.Cisco.com/en/us/docs/solutions/enterprise/security/TrustSec_2.0/trustsec_2.0_dig.PDF

  In addition the Nexus needs a license of Advanced Services installed in order to support the Trustsec.

  I can't comment on any future plans.

• Cisco IOS server certificate - is it supported on routers 857/877

  Please can someone confirm if the certificate of Cisco IOS server feature is supported on the Cisco 857 router. We have checked with the Software Advisor and no picture for the 857 when the server certificate of IOS feature is selected, but advancedIpservices image v 12.4 (11) T arrives to the 877.

  The two 857/877 supports IOS server Certificate

  to 857 you need the ADVANCED SECURITY feature set 12.3 (14) YT

  http://Tools.Cisco.com/ITDIT/CFN/dispatch?Act=feature&ImageID=619356&platformFamily=306&featureSet=8&featureSelected=2208&availSoftwares=iOS

  877 offers more IOSes with Certificate server supports when I chose the certificate server Cisco IOS feature with featured navigator I got a lot of IOSes supporting this feature

  Go to navigator feature

  http://Tools.Cisco.com/ITDIT/CFN/JSP/index.jsp

  Select search by function and select element Cisco IOS Certificate Server, you can filter the results by platform (857/877)

  M.

• Cisco ASA individual certificate for each interface possible?

  Hello

  My ASA actually AnyConnect VPN Client. I have set using ASDM.

  I need to assign a different certificate to my inner interface.
  Can I do this without changing the certificate on the external interface?

  If so, please tell me how this is done. My attempts have been allowed until now to the certificate on the external interface also being changed.

  Kind regards

  Go to Configuration > device management > advanced > settings SSL. There you should be able to choose the Interior of the interface and only associate a secondary certificate to this interface.

  You have to create (or import them from a certification authority) a new certificate already. (Configuration > device management > identity certificates > add)

• Certificate authentication mode?

  I want to try to build a more secure LAN. I want that every client (with or without wire) to connect the network used a certificate not a username/password pair.

  But now, as I am a newbie, I don't know what to choose between GANYMEDE + and RADIUS. Because I have a Mac mini, RAY is perhaps more appropriate, but I don't know how to establish the certification authority.

  Any help or suggestion will be appreciated!

  More generally, we do this in the context of the implementation of a product as of Cisco Identity Services Engine (ISE). ISE uses 802. 1 x and has the ability to check clients for things such as a certificate during authentication / posture assessment / remediation process.

  Also, it acts as a RADIUS server, and can dynamically remove permission (CoA) change to the authenticator (i.e. switch or wireless controller) to control things like the assignment of VLAN client and everything you can apply access lists.

  Client side, a supplicant is used to interact with the authenticator. You can use native supplicants to OS X or Windows, etc, but we generally recommend use of the Cisco AnyConnect Secure Mobility client with its access network (NAM) Module, because it is much more complete for this purpose.

  You could also make 802. 1 x with certificate authentication and use an authentication server different backend (like a regular Cisco ACS or Microsoft Network Policy Server), but you get only basic authentication more vs rich functionality what ISE gives (although ISE is much more ;)).

  Take a look at this Youtube video for an example of setting up certificates of authentication on ACS:

  https://www.YouTube.com/watch?v=U7qWJ7bIMHA