Refer to the exhibit. A network administrator is setting up Cisco AnyConnect on an ASA headend. When users attempt to connect to the VPN, they are presented with this message. The administrator has replaced the ASA's self-signed certificate with a certificate enrolled with the external CA and has confirmed that the certificate is not revoked. Which two tasks will the administrator need to do to prevent users from seeing this message? (Choose two.)

[Exhibit: Cisco AnyConnect Secure Mobility Client window showing "Security Warning: Untrusted Server Certificate!". Details include "AnyConnect cannot verify server: example.cisco.com", "Certificate does not match the server name", "Certificate is from an untrusted source". Buttons: Connect Anyway, Cancel Connection.]

Question

Refer to the exhibit. A network administrator is setting up Cisco AnyConnect on an ASA headend. When users attempt to connect to the VPN, they are presented with this message. The administrator has replaced the ASA's self-signed certificate with a certificate enrolled with the external CA and has confirmed that the certificate is not revoked. Which two tasks will the administrator need to do to prevent users from seeing this message? (Choose two.)

[Exhibit: Cisco AnyConnect Secure Mobility Client window showing "Security Warning: Untrusted Server Certificate!". Details include "AnyConnect cannot verify server: example.cisco.com", "Certificate does not match the server name", "Certificate is from an untrusted source". Buttons: Connect Anyway, Cancel Connection.]

Accepted Answer

A. Trust the issuing CA for the ASA identity certificate on the user's PC. Trusting the issuing CA on the user's PC resolves the 'Certificate is from an untrusted source' warning because TLS chain validation requires the CA that signed the ASA identity certificate to be present in the client OS or browser trust store. B. Enroll and import an SSL certificate with the CN value example.cisco.com on the ASA. Enrolling an SSL certificate with CN value example.cisco.com on the ASA resolves the 'Certificate does not match the server name' error because TLS requires the CN or Subject Alternative Name in the server certificate to match the hostname the client is connecting to.

Answer

C. Add the CN example.cisco.com to the AnyConnect XML certificate matching section. The AnyConnect XML certificate matching section is used to match client certificates for certificate-based user authentication, not to control how the client evaluates the server's identity certificate.

Answer

D. Enable certificate authentication under the connection profile. Enabling certificate authentication under the connection profile configures the method by which users authenticate to the VPN and has no effect on how the client validates the server's certificate trust chain.

Answer

E. Add example.cisco.com to the server name list within the AnyConnect Local Policy. Adding example.cisco.com to the AnyConnect Local Policy server name list can suppress the warning locally on a single endpoint but does not fix the underlying certificate trust or CN mismatch for all users.

Refer to the exhibit. A network administrator is setting up Cisco AnyConnect on an ASA headend. When users attempt to connect to the VPN, they are presented with this message. The administrator has…

Question

Options

How the community answered

Why each option

Topics

Community Discussion