Adding Cert for Anyconnect WebVPN

I have never done this before so bear with me. I am setting up Clientless Anyconnect on ASA 5520. I have a Verisign Cert but when I go to Certificate Management-->CA Certificates-->Add, I put everything in and click "install certificate" I get an error. What am I doing wrong? Any help would be appreciated
FYI I have the Primary Cert Authority Installed already

Here is the steps for your reference:
http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00808b3cff.shtml
Hope that helps.

Similar Messages

Type of cert needed for anyconnect ikeV2

Hi Everyone,
I have created CSR for anyconnect IkeV2.
When i ask the cert vendor what should i ask them that which type of cert i needed for IkeV2?
We do not want users to use ssl like https://xyz.com and connect and download the client.
We want users machine pre installed with anyconnect and profile and connect using IkeV2.
Regards
Mahesh

Hi Marvin,
I got cert from Entrust.
it has 3 options server cert,root cert and chain cert.
i installed the server cert on the ASA and now status of cert has changed from pending.
When i connect to anyconnect ikev2 it still gives me cert warning line non trusted cert.Do i need to do any config change in anyconnect ikev2?
Regards
Mahesh

WebVPN Software Package for AnyConnect

I am trying to configure my 2821 router for AnyConnect following the below link:
http://www.cisco.com/en/US/products/ps5855/products_configuration_example09186a0080af314a.shtml
I came to the following line but I can't find the webvpn package anywhere on the Cisco website. I do not have a windows machine available to me so I can't use CCP, as this guide advises. I can only configure this via command line.
webvpn install svc flash:/webvpn/svc_1.pkg sequence 1
Can anyone advise where I can find this webvpn software package so I can continue with the configuration? Or can someone provide me another set of instructions to get this configured?
Thanks!

Hi,
Jeffrey Simon napisano:Thanks for the post. I just checked out your link. So if Iam to understand this correctly, if I am going to be having Mac and PC computers connecting via AnyConnect I would have to install the package mentioned above in addtion to "Web deployment package for Mac OS X "Intel" platforms" correct?
Yes, that's correct.
Explanation:
anyconnect-win-3.1.03103-k9.pkg -> Web deployment package for Windows platforms
anyconnect-macosx-i386-3.1.03103-k9.pkg -> Web deployment package for Mac OS X "Intel" platforms
anyconnect-macosx-i386-3.1.03103-k9.dmg -> Standalone DMG package for Mac OS X "Intel" platforms
anyconnect-linux-3.1.03103-k9.pkg -> Web deployment package for Linux platforms
anyconnect-predeploy-linux-3.1.03103-k9.tar.gz -> Standalone tarball package for Linux platforms
anyconnect-predeploy-linux-64-3.1.03103-k9.tar.gz -> Standalone package for 64-bit Linux platforms
Do you happen to have a better set of step-by-step instructions for getting the AnyConnect server running on my router? The instructions I was able to find are really GUI based and I am looking to deploy this via command line.
I found some articles on the Internet,but I recommend Cisco documentation
Articles:
(I didn't analyze these documents thoroughly.)
Configuring Cisco SSL VPN AnyConnect (WebVPN) on Cisco IOS Routers
How to configure Cisco VPN SSL aka WebVPN/
Configuring Cisco AnyConnect Tunnel with the CLI
SSL VPN in IOS 12.4T
Cisco:
IOS 12.4T -> SSL VPN Configuration Guide - 12.4T
IOS 15 -> SSL VPN Configuration Guide -15M&T
Best regards,
MB
Please rate all helpful posts
Thx

Force client cert only for anyconnect and not for ssl-clientless?

I need to configure different authentication for anyconnect clients and clients logging in using the ssl portal in the browser.
I want both AAA and certificate for anyconnect but i want ONLY aaa for the ssl portal (clientless)
I tried using two tunnel groups with different authentication settings but i need the same alias available for both clientless and anyconnect and when i tried that it said i cant have two with the same alias.

Did you ever get an answer to this question?
It seems you should be able to set up a two different client profiles. Under Authentication, ssl-client would would specify "Both" and the sslclientless would specify AAA. You would likely have to duplicate much of the other work but the requirement would be satisfied.

AnyConnect error " User not authorized for AnyConnect Client access, contact your administrator"

Hi everyone,
it's probably just me but I have tried real hard to get a simple AnyConnect setup working in a lab environment on my ASA 5505 at home, without luck. When I connect with the AnyConnect client I get the error message "User not authorized for AnyConnect Client access, contact your administrator". I have searched for this error and tried some of the few solutions out there, but to no avail. I also updated the ASA from 8.4.4(1) to 9.1(1) and ASDM from 6.4(9) to 7.1(1) but still the same problem. The setup of the ASA is straight forward, directly connected to the Internet with a 10.0.1.0 / 24 subnet on the inside and an address pool of 10.0.2.0 / 24 to assign to the VPN clients. Please note that due to ISP restrictions, I'm using port 44455 instead of 443. I had AnyConnect working with the SSL portal, but IKEv2 IPsec is giving me a headache. I have stripped down certificate authentication which I had running before just to eliminate this as a potential cause of the issue. When running debugging, I do not get any error messages - the handshake completes successfully and the local authentication works fine as well.
Please find the current config and debugging output below. I appreciate any pointers as to what might be wrong here.
: Saved
ASA Version 9.1(1)
hostname ASA
domain-name ingo.local
enable password ... encrypted
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
passwd ... encrypted
names
name 10.0.1.0 LAN-10-0-1-x
dns-guard
ip local pool VPNPool 10.0.2.1-10.0.2.10 mask 255.255.255.0
interface Ethernet0/0
switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
interface Vlan1
nameif Internal
security-level 100
ip address 10.0.1.254 255.255.255.0
interface Vlan2
nameif External
security-level 0
ip address dhcp setroute
regex BlockFacebook "facebook.com"
banner login This is a monitored system. Unauthorized access is prohibited.
boot system disk0:/asa911-k8.bin
ftp mode passive
clock timezone PST -8
clock summer-time PDT recurring
dns domain-lookup Internal
dns domain-lookup External
dns server-group DefaultDNS
name-server 10.0.1.11
name-server 75.153.176.1
name-server 75.153.176.9
domain-name ingo.local
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network LAN-10-0-1-x
subnet 10.0.1.0 255.255.255.0
object network Company-IP1
host xxx.xxx.xxx.xxx
object network Company-IP2
host xxx.xxx.xxx.xxx
object network HYPER-V-DUAL-IP
range 10.0.1.1 10.0.1.2
object network LAN-10-0-1-X
access-list 100 extended permit tcp any4 object HYPER-V-DUAL-IP eq 3389 inactive
access-list 100 extended permit tcp object Company-IP1 object HYPER-V-DUAL-IP eq 3389
access-list 100 extended permit tcp object Company-IP2 object HYPER-V-DUAL-IP eq 3389
tcp-map Normalizer
check-retransmission
checksum-verification
no pager
logging enable
logging timestamp
logging list Threats message 106023
logging list Threats message 106100
logging list Threats message 106015
logging list Threats message 106021
logging list Threats message 401004
logging buffered errors
logging trap Threats
logging asdm debugging
logging device-id hostname
logging host Internal 10.0.1.11 format emblem
logging ftp-bufferwrap
logging ftp-server 10.0.1.11 / asa *****
logging permit-hostdown
mtu Internal 1500
mtu External 1500
ip verify reverse-path interface Internal
ip verify reverse-path interface External
icmp unreachable rate-limit 1 burst-size 1
icmp deny any echo External
asdm image disk0:/asdm-711.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
object network obj_any
nat (Internal,External) dynamic interface
object network LAN-10-0-1-x
nat (Internal,External) dynamic interface
object network HYPER-V-DUAL-IP
nat (Internal,External) static interface service tcp 3389 3389
access-group 100 in interface External
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa-server radius protocol radius
aaa-server radius (Internal) host 10.0.1.11
key *****
radius-common-pw *****
user-identity default-domain LOCAL
aaa authentication ssh console radius LOCAL
http server enable
http LAN-10-0-1-x 255.255.255.0 Internal
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec ikev2 ipsec-proposal DES
protocol esp encryption des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal 3DES
protocol esp encryption 3des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES
protocol esp encryption aes
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES192
protocol esp encryption aes-192
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES256
protocol esp encryption aes-256
protocol esp integrity sha-1 md5
crypto ipsec security-association pmtu-aging infinite
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
crypto map External_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map External_map interface External
crypto ca trustpoint srv01_trustpoint
enrollment terminal
crl configure
crypto ca trustpoint asa_cert_trustpoint
keypair asa_cert_trustpoint
crl configure
crypto ca trustpoint LOCAL-CA-SERVER
keypair LOCAL-CA-SERVER
crl configure
crypto ca trustpool policy
crypto ca server
cdp-url http://.../+CSCOCA+/asa_ca.crl:44435
issuer-name CN=...
database path disk0:/LOCAL_CA_SERVER/
smtp from-address ...
publish-crl External 44436
crypto ca certificate chain srv01_trustpoint
certificate <output omitted>
quit
crypto ca certificate chain asa_cert_trustpoint
certificate <output omitted>
quit
crypto ca certificate chain LOCAL-CA-SERVER
certificate <output omitted>
quit
crypto ikev2 policy 1
encryption aes-256
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 10
encryption aes-192
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 20
encryption aes
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 30
encryption 3des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 40
encryption des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 enable External client-services port 44455
crypto ikev2 remote-access trustpoint asa_cert_trustpoint
telnet timeout 5
ssh LAN-10-0-1-x 255.255.255.0 Internal
ssh xxx.xxx.xxx.xxx 255.255.255.255 External
ssh xxx.xxx.xxx.xxx 255.255.255.255 External
ssh timeout 5
ssh version 2
console timeout 0
no vpn-addr-assign aaa
no ipv6-vpn-addr-assign aaa
no ipv6-vpn-addr-assign local
dhcpd dns 75.153.176.9 75.153.176.1
dhcpd domain ingo.local
dhcpd option 3 ip 10.0.1.254
dhcpd address 10.0.1.50-10.0.1.81 Internal
dhcpd enable Internal
threat-detection basic-threat
threat-detection scanning-threat shun except ip-address LAN-10-0-1-x 255.255.255.0
threat-detection statistics access-list
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
dynamic-filter use-database
dynamic-filter enable interface Internal
dynamic-filter enable interface External
dynamic-filter drop blacklist interface Internal
dynamic-filter drop blacklist interface External
ntp server 128.233.3.101 source External
ntp server 128.233.3.100 source External prefer
ntp server 204.152.184.72 source External
ntp server 192.6.38.127 source External
ssl encryption aes256-sha1 aes128-sha1 3des-sha1
ssl trust-point asa_cert_trustpoint External
webvpn
port 44433
enable External
dtls port 44433
anyconnect image disk0:/anyconnect-win-3.1.02026-k9.pkg 1
anyconnect profiles profile1 disk0:/profile1.xml
anyconnect enable
smart-tunnel list SmartTunnelList1 mstsc mstsc.exe platform windows
smart-tunnel list SmartTunnelList1 putty putty.exe platform windows
group-policy DfltGrpPolicy attributes
vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec ssl-client ssl-clientless
webvpn
anyconnect profiles value profile1 type user
username write.ingo password ... encrypted
username ingo password ... encrypted privilege 15
username tom.tucker password ... encrypted
class-map TCP
match port tcp range 1 65535
class-map type regex match-any BlockFacebook
match regex BlockFacebook
class-map type inspect http match-all BlockDomains
match request header host regex class BlockFacebook
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 1500
id-randomization
policy-map TCP
class TCP
set connection conn-max 1000 embryonic-conn-max 1000 per-client-max 250 per-client-embryonic-max 250
set connection timeout dcd
set connection advanced-options Normalizer
set connection decrement-ttl
policy-map type inspect http HTTP
parameters
protocol-violation action drop-connection log
class BlockDomains
policy-map global_policy
class inspection_default
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect dns preset_dns_map dynamic-filter-snoop
inspect http HTTP
service-policy global_policy global
service-policy TCP interface External
smtp-server 199.185.220.249
privilege cmd level 3 mode exec command perfmon
privilege cmd level 3 mode exec command ping
privilege cmd level 3 mode exec command who
privilege cmd level 3 mode exec command logging
privilege cmd level 3 mode exec command failover
privilege cmd level 3 mode exec command vpn-sessiondb
privilege cmd level 3 mode exec command packet-tracer
privilege show level 5 mode exec command import
privilege show level 5 mode exec command running-config
privilege show level 3 mode exec command reload
privilege show level 3 mode exec command mode
privilege show level 3 mode exec command firewall
privilege show level 3 mode exec command asp
privilege show level 3 mode exec command cpu
privilege show level 3 mode exec command interface
privilege show level 3 mode exec command clock
privilege show level 3 mode exec command dns-hosts
privilege show level 3 mode exec command access-list
privilege show level 3 mode exec command logging
privilege show level 3 mode exec command vlan
privilege show level 3 mode exec command ip
privilege show level 3 mode exec command failover
privilege show level 3 mode exec command asdm
privilege show level 3 mode exec command arp
privilege show level 3 mode exec command ipv6
privilege show level 3 mode exec command route
privilege show level 3 mode exec command ospf
privilege show level 3 mode exec command aaa-server
privilege show level 3 mode exec command aaa
privilege show level 3 mode exec command eigrp
privilege show level 3 mode exec command crypto
privilege show level 3 mode exec command ssh
privilege show level 3 mode exec command vpn-sessiondb
privilege show level 3 mode exec command vpnclient
privilege show level 3 mode exec command vpn
privilege show level 3 mode exec command dhcpd
privilege show level 3 mode exec command blocks
privilege show level 3 mode exec command wccp
privilege show level 3 mode exec command dynamic-filter
privilege show level 3 mode exec command webvpn
privilege show level 3 mode exec command service-policy
privilege show level 3 mode exec command module
privilege show level 3 mode exec command uauth
privilege show level 3 mode exec command compression
privilege show level 3 mode configure command interface
privilege show level 3 mode configure command clock
privilege show level 3 mode configure command access-list
privilege show level 3 mode configure command logging
privilege show level 3 mode configure command ip
privilege show level 3 mode configure command failover
privilege show level 5 mode configure command asdm
privilege show level 3 mode configure command arp
privilege show level 3 mode configure command route
privilege show level 3 mode configure command aaa-server
privilege show level 3 mode configure command aaa
privilege show level 3 mode configure command crypto
privilege show level 3 mode configure command ssh
privilege show level 3 mode configure command dhcpd
privilege show level 5 mode configure command privilege
privilege clear level 3 mode exec command dns-hosts
privilege clear level 3 mode exec command logging
privilege clear level 3 mode exec command arp
privilege clear level 3 mode exec command aaa-server
privilege clear level 3 mode exec command crypto
privilege clear level 3 mode exec command dynamic-filter
privilege cmd level 3 mode configure command failover
privilege clear level 3 mode configure command logging
privilege clear level 3 mode configure command arp
privilege clear level 3 mode configure command crypto
privilege clear level 3 mode configure command aaa-server
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email [email protected]
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:41a021a28f73c647a2f550ba932bed1a
: end
Many thanks,
Ingo

Hi Jose,
here is what I got now:
ASA(config)# sh run | begin tunnel-group
tunnel-group DefaultWEBVPNGroup general-attributes
address-pool VPNPool
authorization-required
and DAP debugging still the same:
ASA(config)# DAP_TRACE: DAP_open: CDC45080
DAP_TRACE: Username: tom.tucker, aaa.cisco.grouppolicy = DfltGrpPolicy
DAP_TRACE: Username: tom.tucker, aaa.cisco.username = tom.tucker
DAP_TRACE: Username: tom.tucker, aaa.cisco.username1 = tom.tucker
DAP_TRACE: Username: tom.tucker, aaa.cisco.username2 =
DAP_TRACE: Username: tom.tucker, aaa.cisco.tunnelgroup = DefaultWEBVPNGroup
DAP_TRACE: Username: tom.tucker, DAP_add_SCEP: scep required = [FALSE]
DAP_TRACE: Username: tom.tucker, DAP_add_AC:
endpoint.anyconnect.clientversion="3.1.02026";
endpoint.anyconnect.platform="win";
DAP_TRACE: Username: tom.tucker, dap_aggregate_attr: rec_count = 1
DAP_TRACE: Username: tom.tucker, Selected DAPs: DfltAccessPolicy
DAP_TRACE: Username: tom.tucker, DAP_close: CDC45080
Unfortunately, it still doesn't work. Hmmm.. maybe a wipe of the config and starting from scratch can help?
Thanks,
Ingo

ASA self-signed certificate for Anyconnect 3.1, which attributes?

Hi everybody,
I can't find the detailed information which attributes are exactly needed for the Anyconnect 3.1 client to correctly identify the VPN server -ASA 8.4(4)1
I have added two servers in the client connection profile:
IP address, primary protocol IPsec
IP address/non-default port number, primary protocol SSL
Connecting via IPsec only issues a warning about "untrusted source" (I didn't import the certificate as trusted, but that's not the issue)
Connecting via SSL issues an additional warning "Certificate does not match the server name".
The self-signed certificate (created with ASDM) includes the IP address as DN cn, additionally as alternate identity "IP address". I have exported the certificate and parsed it with openssl (after re-encoding to PKCS#12 DER) and apparently no attributes are included.
I would like to give it a try with certtool and openssl to generate a self-signed certificate which is accepted by the Anconnect 3.1, where can I find a detailed description, which attributes are required for Anyconnect SSL sessions? I'm convinced the identity (DN cn) is OK.

Shamelessly bumping this question,
Anyone out there (maybe from Cisco) who can tell us, which atttributes are required on a self signed certificate?
I keep getting "Certificate does not match the Server Name" for SSL-VPN, IPsec-VPN is fine for the same server.

Cannot set up certs for trusted CAs going from 1.4.2_03 to 1.4.2_13

Getting a wierd issue with "Cannot set up certs for trusted CAs" This works if we are using anything less then 1.4.2_07, but the minute we install 1.4.2_07 or 13 as the case may be we get the following Exception:
log9: java.lang.ExceptionInInitializerError
log9: at javax.crypto.Cipher.a(DashoA12275)
log9: at javax.crypto.Cipher.getInstance(DashoA12275)
log9: at com.gm.gwm.common.util.AesUtil.encrypt(AesUtil.java:31)
log9: at com.gm.gwm.common.data.OfflineAuthenticatorDao.updatePassword(OfflineAuthenticatorDao.java:645)
log9: at com.gm.gwm.common.service.OfflineAuthenticatorService.updatePassword(OfflineAuthenticatorService.java:141)
log9: at main.jspService(_main.java:156)
log9: at oracle.jsp.runtime.HttpJsp.service(HttpJsp.java:119)
log9: at oracle.lite.web.JupServlet.service(Unknown Source)
log9: at oracle.lite.web.JspRunner.service(Unknown Source)
log9: at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
log9: at oracle.lite.web.JupServlet.service(Unknown Source)
log9: at oracle.lite.web.MimeServletHandler.handle(Unknown Source)
log9: at oracle.lite.web.JupApplication.handle(Unknown Source)
log9: at oracle.lite.web.JupApplication.service(Unknown Source)
log9: at oracle.lite.web.JupHandler.handle(Unknown Source)
log9: at oracle.lite.web.HTTPServer.process(Unknown Source)
log9: at oracle.lite.web.HTTPServer.handleRequest(Unknown Source)
log9: at oracle.lite.web.JupServer.handle(Unknown Source)
log9: at oracle.lite.web.SocketListener.process(Unknown Source)
log9: at oracle.lite.web.ClientListener.process(Unknown Source)
log9: at oracle.lite.web.SocketListener$ReqHandler.run(Unknown Source)
log9: Caused by: java.lang.SecurityException: Cannot set up certs for trusted CAs
log9: at javax.crypto.SunJCE_b.<clinit>(DashoA12275)
log9: ... 21 more
log9: Caused by: java.lang.IllegalStateException: Already connected
log9: at java.net.URLConnection.setUseCaches(Unknown Source)
log9: at sun.net.www.protocol.jar.JarURLConnection.setUseCaches(Unknown Source)
log9: at javax.crypto.SunJCE_d.a(DashoA12275)
log9: at javax.crypto.SunJCE_b.g(DashoA12275)
log9: at javax.crypto.SunJCE_b.f(DashoA12275)
log9: at javax.crypto.SunJCE_t.run(DashoA12275)
log9: at java.security.AccessController.doPrivileged(Native Method)
Not sure what we are doing wrong.
    public static String encrypt(String value) throws AesException {
          try {
               SecretKeySpec secKeySpec = new SecretKeySpec(fromHexString(encyptKey), algorithm);
               Provider provider = new SunJCE();
              Security.addProvider(provider);
            Cipher cipher = Cipher.getInstance(algorithm, provider);
               cipher.init(Cipher.ENCRYPT_MODE, secKeySpec);
               byte[] encryptedBytes = cipher.doFinal(value.getBytes());
               return toHexString(encryptedBytes);
          } catch (Exception e) {
               throw new AesException(e);
     }

I added that late just in case, for some strange reason, the provider wasn't getting picked up.
Here is the list of available providers:
log9: SUN (DSA key/parameter generation; DSA signing; SHA-1, MD5 digests; SecureRandom; X.509 certificates; JKS keystore
; PKIX CertPathValidator; PKIX CertPathBuilder; LDAP, Collection CertStores)
log9: Sun JSSE provider(implements RSA Signatures, PKCS12, SunX509 key/trust factories, SSLv3, TLSv1)
log9: SUN's provider for RSA signatures
log9: SunJCE Provider (implements DES, Triple DES, AES, Blowfish, PBE, Diffie-Hellman, HMAC-MD5, HMAC-SHA1)
log9: Sun (Kerberos v5)
log9: java.lang.ExceptionInInitializerError
The minute I rollback to an older JVM this works.

Anyconnect/Webvpn different ip

Hi,
We have an ASA5510 with the Anyconnect Essentials license. I'm in the process of setting up Anyconnect and immediately run into a question. We have a /29 subnet setup and AFAIK i must use the outside interface address for Anyconnect. However i already have an https service PAT forward on this address. So, can i setup Anyconnect to listen on eg. the second ip in my public subnet?
Thanks,
Dennes
Sent from Cisco Technical Support iPhone App

You have to use the outside IP address for the WebVPN and anyconnect VPN. However, if you are using port 443 for another pat you can specify the webvpn to use something like 8443 instead for the webvpn using the same outside IP address for both connections. Here is an example of how to change the webvpn port.
config t
webvpn
enable outside
port 8443
Sent from Cisco Technical Support iPad App

JCE SecurityException: Cannot set up certs for trusted CAs

hi,
I am using trying to Jar an application that uses the JCE
package for encryption.
When running the jar file the following exception ocurss:
java.lang.ExceptionInInitializerError: java.lang.SecurityException: Cannot set up certs for trusted CAs
at javax.crypto.b.<clinit>([DashoPro-V1.2-120198])
at javax.crypto.Cipher.getInstance([DashoPro-V1.2-120198])
at com.portland.encryption.Decrypter.decryptServer(Decrypter.java:67)
at com.portland.util.ModelLoad.loadObj(ModelLoad.java:53)
at com.portland.setup.SetUpInit.isUserFrameNeeded(SetUpInit.java:86)
at com.portland.setup.SetUpInit.checkResources(SetUpInit.java:29)
at com.portland.setup.SetUpInit.main(SetUpInit.java:99)
Exception in thread "main"
Is there any way arround this problem???

hi,
I am using trying to Jar an application that uses the
JCE
package for encryption.
When running the jar file the following exception
ocurss:
java.lang.ExceptionInInitializerError:
java.lang.SecurityException: Cannot set up certs for
trusted CAs
at
at
at javax.crypto.b.<clinit>([DashoPro-V1.2-120198])
at
at
at
t
javax.crypto.Cipher.getInstance([DashoPro-V1.2-120198])
at
at
at
t
com.portland.encryption.Decrypter.decryptServer(Decrypt
r.java:67)
at
at
at
t
com.portland.util.ModelLoad.loadObj(ModelLoad.java:53)
at
at
at
t
com.portland.setup.SetUpInit.isUserFrameNeeded(SetUpIni
.java:86)
at
at
at
t
com.portland.setup.SetUpInit.checkResources(SetUpInit.j
va:29)
at
at
at
t
com.portland.setup.SetUpInit.main(SetUpInit.java:99)
Exception in thread "main"
Is there any way arround this problem???A few questions for you:
(1) Have you updated the java.security file to include the SunJCE security provider i.e. :
<JAVA_HOME>/jre/lib/security/java.security
a line should be added into this file as such:
security.provider.n=com.sun.crypto.provider.SunJCE
, where n is the the order of which the security providers to be installed.
(2) You should have all the necessary .jar files for the JCE packages and it should located in this directory:
<JAVA_HOME>/jre/lib/ext
Some developers make the mistake of copying the .jar files into the <JAVA_HOME>/lib directory.
HTH.
Allen Lai
Developer Technical Support
SUN Microsystems
http://www.sun.com/developers/support/

Specifying Client Auth Cert in Anyconnect NAM

Hi guys,
Currently i have set up an SSID which uses EAP-FAST to perform user certificate authentication against an Identity store in ISE connected to AD. On the client devices I have install the Anyconnect NAM to act as the dot1x supplicant and have been in the process of setting up the profile using the Anyconnect Profile Editor.
The issue that I am having is users on the network have several certs assigned to them from AD. Orindarily it the NAM just prompts the user to select the correct certificate when they attempt to connect, which is not feasible.
Can I configure the NAM to use a specific user Cert to authenticate to the SSID (without prompting the user on connection)? And if so how?
Thanks

Hello Evan,
Please check the following Cisco doc for specifying client auth cert in anyconnect. Hope it helps!
http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect24/administration/guide/ac02asaconfig.html

SecurityException: Cannot set up certs for trusted CAs

I'm pressed for a solution to meet a delivery deadline - any help would
be appreciated.
I have a method that requests an instance of a SecretKeyFactory. The
method works in a standalone application and in JRun which we use for
development but when i try it in iPlanet iAS6 SP2 I get the following
Exception listed below. (following the Exception is the code that
generated it).
java.lang.ExceptionInInitializerError: java.lang.SecurityException:
Cannot set up certs for trusted CAs
at javax.crypto.b.<clinit>([DashoPro-V1.2-120198])
at
javax.crypto.SecretKeyFactory.getInstance([DashoPro-V1.2-120198])
at
com.intellisales.shared.services.DESede.generatePrivateKeyFromFile(DESede.java:151)
at
com.intellisales.shared.services.DESede.<init>(DESede.java:60)
at
com.intellisales.gbsld1.servlets.BellServlet.doGet(BellServlet.java:169)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:740)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:865)
at
com.netscape.server.servlet.servletrunner.ServletInfo.service(Unknown
Source)
at
com.netscape.server.servlet.servletrunner.ServletRunner.execute(Unknown
Source)
at com.kivasoft.applogic.AppLogic.execute(Unknown Source)
at com.kivasoft.applogic.AppLogic.execute(Unknown Source)
at com.kivasoft.thread.ThreadBasic.run(Native Method)
at java.lang.Thread.run(Thread.java:479)
java.lang.ExceptionInInitializerError: java.lang.SecurityException:
Cannot set up certs for trusted CAs
at javax.crypto.b.<clinit>([DashoPro-V1.2-120198])
at
javax.crypto.SecretKeyFactory.getInstance([DashoPro-V1.2-120198])
at
com.intellisales.shared.services.DESede.generatePrivateKeyFromFile(DESede.java:151)
at
com.intellisales.shared.services.DESede.<init>(DESede.java:60)
at
com.intellisales.gbsld1.servlets.BellServlet.doGet(BellServlet.java:169)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:740)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:865)
at
com.netscape.server.servlet.servletrunner.ServletInfo.service(Unknown
Source)
at
com.netscape.server.servlet.servletrunner.ServletRunner.execute(Unknown
Source)
at com.kivasoft.applogic.AppLogic.execute(Unknown Source)
at com.kivasoft.applogic.AppLogic.execute(Unknown Source)
at com.kivasoft.thread.ThreadBasic.run(Native Method)
at java.lang.Thread.run(Thread.java:479)
public SecretKey generatePrivateKeyFromFile(){
FileInputStream pfis = null;
SecretKey seckey = null;
try {
Security.addProvider(new sun.security.provider.Sun());
Security.addProvider(new com.sun.crypto.provider.SunJCE());
// *** get secret key ***
pfis = new FileInputStream(keyFileName);
byte[] encKey = new byte[pfis.available()];
pfis.read(encKey);
pfis.close();
SecretKeyFactory mykeyfac1 =
SecretKeyFactory.getInstance("DESede");
DESedeKeySpec dk = new DESedeKeySpec(encKey);
seckey = mykeyfac1.generateSecret(dk);
byte[] key = seckey.getEncoded();
} catch (Exception e){
e.printStackTrace();
return seckey;
}// end generatePrivateKeyFromFile
Thanks

hi,
I am using trying to Jar an application that uses the
JCE
package for encryption.
When running the jar file the following exception
ocurss:
java.lang.ExceptionInInitializerError:
java.lang.SecurityException: Cannot set up certs for
trusted CAs
at
at
at javax.crypto.b.<clinit>([DashoPro-V1.2-120198])
at
at
at
t
javax.crypto.Cipher.getInstance([DashoPro-V1.2-120198])
at
at
at
t
com.portland.encryption.Decrypter.decryptServer(Decrypt
r.java:67)
at
at
at
t
com.portland.util.ModelLoad.loadObj(ModelLoad.java:53)
at
at
at
t
com.portland.setup.SetUpInit.isUserFrameNeeded(SetUpIni
.java:86)
at
at
at
t
com.portland.setup.SetUpInit.checkResources(SetUpInit.j
va:29)
at
at
at
t
com.portland.setup.SetUpInit.main(SetUpInit.java:99)
Exception in thread "main"
Is there any way arround this problem???A few questions for you:
(1) Have you updated the java.security file to include the SunJCE security provider i.e. :
<JAVA_HOME>/jre/lib/security/java.security
a line should be added into this file as such:
security.provider.n=com.sun.crypto.provider.SunJCE
, where n is the the order of which the security providers to be installed.
(2) You should have all the necessary .jar files for the JCE packages and it should located in this directory:
<JAVA_HOME>/jre/lib/ext
Some developers make the mistake of copying the .jar files into the <JAVA_HOME>/lib directory.
HTH.
Allen Lai
Developer Technical Support
SUN Microsystems
http://www.sun.com/developers/support/

Adding listeners for instances on other frames

I'm trying to create a very standard menu, the type where there are links on each page that links to each other. So far I've put each menu page on a separate frame (total around 35 frames), and each link as its own instance/class. Originally I planned to create an array containing all the links like this:
var menuLinks:Array =
                            //Main menu - frame 1
                            menuRightSide.newStoryLink,
                            menuRightSide.continueStoryLink,
                            menuRightSide.selectChapterLink,
                            menuRightSide.optionsLink,
                            menuRightSide.charactersLink,
                            menuRightSide.aboutLink,
                            //chapters menu - frame 2
                            menuRightSide.chapter1,
                            menuRightSide.chapter2,
                            menuRightSide.chapter3,
                            menuRightSide.chapter4,
                            menuRightSide.chapter5,
                            //characters - frame 3
                            menuRightSide.char1,
                            menuRightSide.char2,
                            menuRightSide.char3,
                            menuRightSide.char4,
                            menuRightSide.char5,
                            menuRightSide.char6,
                            //options - frame 4
                            menuRightSide.languageLink,
                            menuRightSide.costumeLink,
                            //function links - these exist on MULTIPLE frames/pages, eg options, characters, chapters all have backToMainLink
                            menuRightSide.backToMainLink,
                            menuRightSide.backToCharLink,
                            menuRightSide.backToOptionsLink,
                            menuRightSide.backToCostumeLink,
                            ]; //create array of links for menus
            currentPage = "main_menu";
            for each (var links:MovieClip in menuLinks)
                links.buttonMode = true; //set links to behave like button
                links.mouseChildren = false; //mouse over does not affect this instance's children
                links.addEventListener(MouseEvent.ROLL_OVER, onOver);
                links.addEventListener(MouseEvent.ROLL_OUT, onOut);
                links.addEventListener(MouseEvent.CLICK, onClick);
            function onOver(e:MouseEvent):void //apply glow to every link
                TweenMax.to(e.target, 1, {glowFilter:{color:0xFFFFFF, alpha:1, blurX:10, blurY:10}}); //glow effect
            function onOut(e:MouseEvent):void //remove glow on link on mouse out
                TweenMax.to(e.target, 1, {glowFilter:{color:0xFFFFFF, alpha:0, blurX:0, blurY:0, remove:true}}); //remove glow
            function onClick(e:MouseEvent):void
                currentPage = e.target.name;
                if (e.target.name == "newStoryLink") { //if click newStoryLink
                    delegate.beginStory();
                } else if (e.target.name == "optionsLink") { //if click optionsLink
                    TweenLite.to(menuRightSide, 0.2, {alpha:0, onComplete:menuRightSide.gotoAndStop, onCompleteParams:[45]}); //go to frame 45, options screen
                    TweenLite.to(menuRightSide, 0.2, {alpha:1, delay:0.2});
                } else if (e.target.name == "charactersLink") { //if click charactersLink
                    TweenLite.to(menuRightSide, 0.2, {alpha:0, onComplete:menuRightSide.gotoAndStop, onCompleteParams:[10]}); //go to frame 10, char screen
                    TweenLite.to(menuRightSide, 0.2, {alpha:1, delay:0.2});
                } else if (e.target.name == "aboutLink") { //if click aboutLink
                    TweenLite.to(menuRightSide, 0.2, {alpha:0, onComplete:menuRightSide.gotoAndStop, onCompleteParams:[180]}); //go to frame 180, about screen
                    TweenLite.to(menuRightSide, 0.2, {alpha:1, delay:0.2});
Basically adding listener for every link, then simply telling AS what to do when I click the link regardless of what page I'm currently on.
However the problem is I realized listeners can't be added for links that exist on other frames other than frame 1, because they're null I think until AS flips to that frame.
So does anyone have an idea on how I should code this? Another challenge is some links (the ones at the bottom of the array) exist on MULTIPLE frames, but perform the exact same thing regardless of which page it was clicked on.
Thanks.

I arranged them on separate frames because that way I know exactly what's on each page. If I simply list out all the links on one frame, then it gets extremely messy visually.
So if I want to add listeners on other frames, how would I do that? I know the pseudo-code:
on frame 1:
for (each link on frame 1) {
link.addEventListener()
on frame 2:
for (each link on frame 2) {
link.addEventListener()
... etc
function onClick(e:MouseEvent):void
                currentPage = e.target.name;
                if (e.target.name == "newStoryLink") {
                    delegate.beginStory();
                } else if (e.target.name == "continueStoryLink") {
                    //do something else

Using keytool to generate self signed cert. for Microsft Certificate Mrg.

Hi All,
I want to be able to generate a self signed certificate that I can Import into
Microsoft's Certificate Manager, to enable an HTTPS Listener for
Microsoft's WinRM and WinRS.
The certificate would only be for internal use, not used externally.
Here's the problem. I can create a certificate using this (path obscured):
"C:\Program Files\.....\jre\bin\keytool" -genkey -al
ias dMobX -keyalg RSA -keysize 1024 -sigalg SHA1withRSA -dname "CN=your-f5c57803
53" -keypass changeit -validity 90 -storetype pkcs12 -keystore "C:\Program Files
\......\jre\lib\keystore\.keystore" -storepass changeit
"C:\Program Files\......\jre\bin\keytool" -export -alias dMob
X -file "C:\Program Files\......\jre\lib\keystore\dMobX.cer" -stor
etype pkcs12 -keystore "C:\Program Files\.......\jre\lib\keystore\.
keystore" -storepass changeit -v
Microsoft's Certificate Manager will accept it, the .cer, using "Import", into
Trusted Root Certification Authorities, but when I run the command to create the HTTPS Listener, I get this error message:
The WS-Management service cannot find the certificate that was requested.
If I use another tool, like selfssl, I can generate a self signed certificate using:
selfssl /N:CN=your-f5c5780353 /K:1024 /V:90 /P:443 /T
This will populate a certificate in Trusted Root Certification Authorities,
and when I run the command to create the HTTPS Listener, it succeeds with
no problem.
So my question is, am I doing something wrong with keytool, or are there
extra steps that I need to take, or is it even capable of generating a "self signed
certificate" that will work in the above case?
There are some concepts involved, certificate wise, that I'm not sure about.
Do I need to create a CSR and use a tool like openssl, as a CA, and
use the resulting certificate?
I just want to be able to programmatically create the needed certificate using keytool, or
using an API.
Thanks,

Download the latest JDK on http://download.java.net/jdk7/binaries/.
Run "keytool -genkeypair -ext KU=? -ext EKU=? ...". Substitute the "?" with the usages you see in the other cert (for example, "digitalSignature" or "codeSigning". If there are multiple ones, separate with comma).

[svn:osmf:] 11848: Added check for argument error DRM subsystem throws while generating a DRMContentInfo Object .

Revision: 11848
Revision: 11848
Author:   [email protected]
Date:     2009-11-16 10:00:48 -0800 (Mon, 16 Nov 2009)
Log Message:
Added check for argument error DRM subsystem throws while generating a DRMContentInfo Object.
Modified Paths:
    osmf/trunk/framework/MediaFramework/org/osmf/drm/DRMServices.as

Well, I can tell you that this kind of error is not OS related, but rather a HW thing. It happens where there is a general detection of something going wrong. Sometimes it can happen randomly and might not be an indication of a problem. But sometimes it can be caused by things that are improperly functioning within the system like bad capacitors.
Unfortunately I don't really know what to do about such things except give you machine a proper inspection. But if things are working fine, and continue to do so, I wouldn't worry about it. If it becomes a regular occurance, then I'd worry.

How can i get newly added contacts for a Mailbox User in Exchange Server 2013

Hi all,
I need to synchronize contacts in Exchange Server and Sugar CRM Application, for that
i need to get newly added contacts for a User in Exchange Server 2013 by using EWS Managed API.
I know how get the list of all contacts for a particular user , but in the list how i can find
new contacts ?

Hi Dora,
that's the fun thing:
You add your own property (and it'll be invisible to outlook users, not to worry).
Extended Properties allow you to define custom property on Exchange Items. And it has a
method for setting those too.
Here's a short post doing a very simple intro on using Extended Properties.
Glen's Exchange Blog is a generally useful resource when working with EWS, I'm confident you'll be able to find lots of tips there as well.
Cheers,
Fred
There's no place like 127.0.0.1

Adding Cert for Anyconnect WebVPN

Similar Messages

Maybe you are looking for