certificate validation failure cisco anyconnect

PKI: Evaluating session revocation status, 1 certs to checkĬRYPTO_PKI: Attempting to find OCSP override for peer cert: serial number:, subject name: CN=test1,CN=Users,DC=mylab,DC=local, issuer_name: CN=WIN-2K12-01-CA,DC=mylab,DC=local. PKI: Chain revocation status: good: 0, exempt: 0, cached: 0, revoked: 0, error: 0, pending: 1 PKI: revocation status queued for session 0x14981ed1 and cert_idx 0, rev_status 6 Check administrator guide on how to configure client certificates for Linux platform. I then enabled debug crypto ca 7 on the ASA, and I tried to establish the VPN tunnel again to capture some debug. An圜onnect supports PEM format client certificates for authentication. I also checked the OCSP configuration on the Windows server and all was looking good and functional. This trust point is configured with OCSP for the revocation check. the vpn client doesnt connect with : error 32 unable to verify certificate. I found this as about anyconnect, ikev2 remote access vpn and ASA: An圜onnect Over IKEv2 to ASA with AAA and Certificate Authentication - Cisco I think, if you do not create an anyconnect profile in xml, anyconnect will use sslvpn instead of ikev2 remote access vpn. Similarly on the ASA side, the ASA identity certificate was looking good, as well as the trust point that is responsible to authenticate the clients. i tried to test my working cisco vpn connection from my laptop and now but i. Checking on the client side, all was looking good, and the user and machine certs were successfully installed, and the issuer root CA certificate was in the trusted store.

I thought there was something wrong with the client certificate or maybe the trust point on the ASA that is configured to authenticate An圜onnect clients. I was working on setting up a Cisco An圜onnect Management Tunnel, which I will cover in another post, and for some reason when I was trying to establish An圜onnect SSL VPN from a Windows client, it was just failing dropping the message Certificate Validation Failure on the screen. This post will cover one interesting root cause of getting An圜onnect Certificate Validation Failure.

Certificate validation failure cisco anyconnect