Skip to main content

Installing and activating SSL Certificate on Cisco ASA Firewall

If your firewall outside interfacing is facing outside network for remote management or using SSL VPN, you should deploy SSL certificate rather than self-signed certificate to get better security.

So, below steps can help you at "how to install and activate ssl certificate" on your Cisco ASA Firewall.

You only need 3 steps to do that.

1) Create TrustPoint and Generate a CSR
2) Enroll for Certificate
3) Install



But your Cisco ASA firewall must meet below requirement to do above steps.
1) Your ASA Firewall Software Version should be 8.0 and above.
2) You ASDM version should be 6.0 and above.

You can do above steps via Command Line but you can do mistake very easily if you are not CLI experts and this is first time for you.
So, I'd recommed you to use ASDM.

Step 1 & 2 :  Generate TrustPoint and CSR, Enroll for Certificate

a) Generate TrustPoint and Key pair

1) Within ASDM, click Configuration > Device Management
2) Click Certificate Management > Identity Certificates > Add > Add a new identity certificate (Take note the TrustPoint Name in this steps as you need to use it with generate key later)
3) For the Key Pair, click New > Enter new key pair name
4) Enter a unique key pair name for the certificate
5) Select the key size as 2048
6) To complete the generation of the key pair, click Generate Now




b) Generate a certificate signing request (CSR) file

1) To enter certificate information, click Select
2) From the drop-down list, select the following attributes > enter value > click Add
3) The following fields are required:

- Country Name (C): Use the two-letter code without punctuation for country, for example: US or CA.
- State or Province (S): Spell out the state completely; do not abbreviate the state or province name, for example: California.
- Locality or City (L): The Locality field is the city or town name, for example: Berkeley.
- Organization (O): If your company or department has an &, @, or any other symbol using the shift key in its name, you must spell out the symbol or omit it to enroll, for example: XY & Z Corporation would be XYZ Corporation or XY and Z Corporation.
- Organizational Unit (OU): This field is the name of the department or organization unit making the request.
- Common Name (CN): The Common Name is the Host + Domain Name. It looks like "www.company.com" or "company.com".

4) Once the appropriate values are added, click OK > Advanced
5) In the FQDN field, enter the FQDN that will be used to access the device from the Internet:
NOTE - If enrolling for a Subject Alternative Name certificate leave this field blank.
6) Click OK >  Add Certificate > Browse
7) Choose a location where to save the request file
8) In this step, you can go Publisher Website and verify your CSR for the information you put above whether correct or not.
9) Once you confirmed all information, proceed with Enrollment.


3) Install the SSL Certificate

After you wait around 30 minutes (miniumun) to 3 days (maximum), your SSL Certificate will be ready to use.
The Publisher will send your certificate via email to you or you can download it from their website too.

For Cisco ASA SSL Certificate installation, you need below certificate download and save them in your PC as (.pem or .crt format) first.
- Root CA Certificate
- Primary and Secondary Intermediate CA Certificates

Let's install Root and Intermediate CA certificates now.

a) Install the Symantec Root  (CA) Certificate

1) Within ASDM, click Configuration > Device Management
2) Click Certificate Management > CA Certificates
3) Click Add
4) Click Paste certificate in PEM Format > paste the root certificate into the text field  (Open saved Root Certificate with Notepad and copy, paste)
5) Click Install Certificate

A dialog box appears that confirms the installation was successful.


b) Install the Symantec Intermediate (CA) Certificates

1) Within ASDM, click Configuration > Device Management
2) Click Certificate Management > CA Certificates
3) Click Add
4) Click Paste certificate in PEM Format > paste the Primary Intermediate certificate into the text field  (Open saved Intermediate Certificate with Notepad and copy, paste)
5) Click Install Certificate
6) Repeat the same steps to install the Secondary Intermediate certificate

A dialog box appears that confirms the installation was successful.

c) Obtain the SSL Certificate

1) The SSL certificate will be sent from publisher by email. The certificate is included as an attachment (Cert.cer) and it is also imbedded in the body of the email.
2) Copy and paste the certificate into a text file using Notepad

The text file should look like:

-----BEGIN CERTIFICATE-----
   
        [encoded data]

-----END CERTIFICATE-----

3) Make sure there are 5 dashes to either side of the BEGIN CERTIFICATE and END CERTIFICATE and that no white spaces,
extra line breaks or additional characters have been inadvertently added.

NOTE: You can also download the certificate from your Publisher account at their website.

 4) Save the file as (.pem or .crt format) in your PC.

d)  Install the SSL Certificate

1) Click Configuration > Device Management
2) Click Certificate Management > Identity Certificates
3) Select the identity certificate you created (The Expiry Date should display Pending)
4) Click Install
5) Click Paste the certificate data in base-64 format > paste the certificate into the text field
6) Click Install Certificate

A dialog box appears that confirms the installation was successful.

e) Activate the newly installed SSL certificate for use

1) Click Configuration > Device Management
2) Expand Advanced, and then expand SSL Settings
3) Under Certificates, select the interface that is used to termintate WebVPN sessions
4) Click Edit
5) In the Certificate drop-down list, choose the certificate that you just installed
6) Click OK
7) Click Apply
8) Your new certificate should now be activated for use with your ASA.
9) You can verify the installation of your certificate with tools that provide from publisher or tools from third party publisher (like digicert).

Yes. Now your SSL Certificate has been installed and activated.

May you all be happy.
(Be knowledgeable, pass it on then)

Comments

Popular posts from this blog

Fortigate guide for Begineer - 6

I would like to explaine how to troubleshoot the Fortigate Unit configured by Transparent Mode in step by step this time. Let's assume, you have one Fortigate Unit that configured as Transparent Mode. But devices from Internal/Private Network unable to access Internet/Public Network through your Fortigate Unit. OK. Let's troubleshoot with following steps, 1) Check the physical network connections between the network and the FortiGate unit, and between the FortiGate unit and the Internet. 2) Check the router and ISP-supplied equipment to make sure it is operating correctly. 3) Verify that you can connect to the internal interface by connecting to the management IP address of the FortiGate unit from the Internal network. From the internal network, attempt to ping the management IP address. If you cannot connect to the internal interface, verify the IP configuration of the PC and make sure the cables are connected and all switches and other devices on the network are powered on a

Solving the "A general system error occured:Invalid fault" error in vSphere 4

Below error was come out when you try to migrate VM to other host for some reason. Below error was come out when you try to edit VM setting. Below error was come out when you power on the VM. How to solve those error? Here is how I resolve the error! Login to the Host that errored VM exist by using Terminal or Direct Console. Enter below command and press enter. services.sh restart Wait until all VMware Services are restarted. After that try to Power On/Edit Settings or Migrate the errored VM and you will see all you can do without any error pop-up. This kind of errors can occur if you shutdown/restart VM unproperly or shutdown/restart the Host unproperly that VM exist. You can check log file deeply if you willing to know precisely on this. May you all be happy. (Be knowledgeable, pass it on then)

Link Aggregating with Synology NAS and Cisco Switch

I’d like to share how to setup Link Aggregating between Synology NAS and Cisco Switch. I’ve got one Synology NAS with 4 Network Ports and I’m going to use 2 of them. Both Network Port to be as one Logical Link, Fault Tolerance and Load Balancing. To do that, I need to configure Link Aggregating on Synology NAS and EtherChannel with LACP on Cisco Switch. Below is brief steps to do to meet with my requirements. - Get connected Synology NAS and Cisco Switch as shown in picture. - Bonding two Network Ports of Synology NAS and assign IP Address - Configure EtherChannel with LACP in Cisco Switch and add two physical ports as Member. OK. Let’s begin from Synology NAS. - Login to the Synology and go to Control Panel>Network>Create>Create Bond - Select IEEE 802.3ad to get Fault Tolerance and Load Balancing Featureyou’re your switch not support 802.3ad you can only select Fault Tolerance only feature). After that click “Next”. - Choose the network port f