ASA Export/Import Certificate

  • Post author:
  • Post category:ASA / Cisco

This post provides step-by-step procedure to export/import the SSL certificate used by the Cisco ASA using CLI and ASDM.

Export/Import via CLI

View the current CA/Identity certificate and identify the Trustpoint.

show crypto ca certificates

Export the Trustpoint configuration, keys and certificates in PKCS12 with a password.

crypto ca export <trustpoint> pkcs12 <passphrase>

On the new ASA import the certificate, the Trustpoint name does not need to match the previous Trustpoint name. The passphrase used to import the pkcs12 file, will be the same used when exporting in the previous step.

crypto ca import <trustpoint> pkcs12 <passphrase>

To use the certificate for SSL-VPN, specify which Trustpoint should be used on the interface.

ssl Trustpoint <trustpoint> OUTSIDE

Export/Import via ASDM

  • Navigate to Configuration > Remote Access VPN > Certificate Management > Identity Certificates

Confirm the presence of the Identity certificate

  • Click Export
  • Choose a locate to export the file
  • Enter the Encryption Passphrase and confirm passphrase

  • On the new ASA navigate to the same location Configuration > Remote Access VPN > Certificate Management > Identity Certificates
  • Click Add
  • Enter a Trustpoint Name (this does not need to be the same as the old Trustpoint name)
  • Enter the Decryption Passphrase (this passphrase is the same as the passphrase used to encrypt the file)
  • Select the location to import the file
  • Click Add Certificate

  • Click Send
  • Click Ok

  • Navigate to Configuration > Remote Access VPN > Advanced > SSL Settings
  • Select OUTSIDE interface and click Edit
  • From the drop-down list select the certificate to attach to the Primary Enrolled Certificate

  • Click Apply to save all changes

Verification

  • On the ASDM navigate to Configuration > Remote Access VPN > Certificate Management > CA Certificates

Confirm the presence of the correct CA certificate

  • Navigate to Configuration > Remote Access VPN > Certificate Management > Identity Certificates

Confirm the presence of the correct Identity certificate

  • From the CLI type show crypto ca certificates to confirm the CA and Identity Certificates.

 

 

 

Tags: , , , ,