How to generate a CSR in Cisco ASA 5500 SSL VPN/Firewall
1. From the Cisco Adaptive Security Device Manager (ASDM), select \
Management.\
2. Expand \
3. Select the button to \
4. Select the option to \
the \
Change the key size to 2048 and leave Usage on General purpose.
5. Next you will define the \
the Certificate Subject DN window, configure the following values by selecting each from the \drop-down list, entering the appropriate value, and clicking \
CN - The name through which the firewall will be accessed (usually the fully-qualified domain name, e.g., vpn.domain.com).
OU - The name of your department within the organization (frequently this entry will be listed as \\
O - The legally registered name of your organization/company. C - If you do not know your country's two digit code, find it on our list. ST - The state in which your organization is located. L - The city in which your organization is located.
Please note: None of the above fields should exceed a 64 character limit. Exceeding that limit could cause problems later on while trying to install your certificate.
6. Next, click \
7. In the FQDN field, type in the fully-qualified domain name through which the device will be accessed
externally, e.g., vpn.domain.com (or the same name as was entered in the CN value in step 5).
8. Click \
information as a text file (.txt extension).
Remember the filename that you choose and the location to which you save it. You will need to open this file as a text file and copy the entire body of it (including the Begin and End Certificate Request tags) into the online order process when prompted.
Installing your SSL Certificate in the Adaptive Security Device Manager (ASDM)
1. You will receive your SSL certificate and intermediate certificate by email. Copy each certificate from the email, paste
each one into a separate text editor and save the files to a safe location with an extension of .crt, such as gs_sslcertificate.crt and gs_intermediate.crt.
2. In ASDM select “Configuration” and then “Device Management.”
3. Expand “Certificate Management” and select “CA Certificates” and then “Add.”
4. With the option selected to “Install from a file”, browse to the gs_intermediate.crt file and then click the “Install
Certificate” button at the bottom of the \
Your Intermediate certificate file is now installed. You will now need to install the gs_sslcertificate.crt file. 5. In ASDM select “Configuration” and then “Device Management”. 6. Expand “Certificate Management” and select “Identity Certificates”.
7. Select the appropriate identity certificate from when your CSR was generated (the “Issued By” field should show as
not available and the “Expiry Date” field will show Pending…). Click the Install button.
8. Browse to the appropriate identity certificate (the gs_sslcertificate.crt provided by GlobalSign) and click “Install
Certificate.”
At this point you should receive confirmation that the certificate installation was successful. Configuring WebVPN with ASDM to Use the New SSL Certificate 1. In ASDM select “Configuration” and then “Device Management”. 2. Click “Advanced” and then “SSL Settings”
3. From \ 4. From the “Certificate” drop-down, select the newly installed certificate, then “OK”, and then “Apply”
Configuring your certificate for use with the selected kind of WebVPN session is now complete. SSL Certificate Installation from the Cisco ASA command line (alternate installation method) 1. From the ciscoasa(config)# line, enter the following text:
cryptoca authenticate my.globalsign.trustpoint
Where my.globalsign.trustpoint is the name of trustpoint created when your certificate request was generated.
2. Next, enter the entire body of the gs_intermediate.crt file followed by the word “quit” on a line by itself (the
gs_intermediate.crt file can be opened and edited with a standard text editor, and the entire body of that file should be entered when prompted).
3. When asked to accept the certificate, enter “yes”.
4. When the certificate has been successfully imported, enter “exit”.
Your Intermediate certificate file is now installed. You will now need to install the gs_sslcertificate.crt file. 5. From the ciscoasa(config)# line, enter the following text:
cryptoca import my.globalsign.trustpoint certificate
Where my.globalsign.trustpoint is the name of trustpoint created when your certificate request was generated.
6. Next, enter the entire body of the gs_sslcertificate.crt file followed by the word “quit” on a line by itself (the
gs_sslcertificate.crt file can be opened and edited with a standard text editor, and the entire body of that file should be entered when prompted).
You should then receive a message that the certificate was successfully imported. Configuring WebVPN to Use the New SSL Certificate from the Cisco ASA command line 1. From the ciscoasa(config)# line, enter the following text:
ssl trust-point my.globalsign.trustpoint outside wrmem
Where my.globalsign.trustpoint is the name of trustpoint created when your certificate request was generated and \Make sure to save the configuration.
Install your Certificates in Cisco ASA 5500 SSL VPN Firewall
