[AnyConnect] No valid certificates available for authentication

Hi,
We are using Cisco Anyconnect 3.0.0629 with certificate authentication (stored in Aladdin eToken)
Most of users have no problem and it works fine.
When one user tried to connect, he got a lot of errors "No valid certificates available for authentication" during 30 seconds. (~10 errors per second)
In a normal behaviour, we should have only one error.
Why is AnyConnect flooding this error?
How could I resolve it?
Thanks for your help,
Patrick

I also had the problem of "no valid certificates available for authentication", although it only prompted once, rather than a flood like the OP.
However, the cause and solution for my problem was:
The certificate used for authentication was issued by my internal CA, to the Computer, NOT the user.
Although the user that is logged on is a local administrator, the AnyConnect Client application does not have the permission to send the certificate from the Computer store.
The application needs to 'run as administrator'
Right-click the application shortcut-> Properties->Compatibility->Privilege Level.
Tick ->Run This Program As Administrator.
I needed to reboot the client pc before this worked.
n.b I was using Windows 8

Similar Messages

AnyConnect 3.1.05160 - no valid certificates available for authentication

Hi all,
one of our customer is running the above AC version and hitting the above error.
form the DART file I gathered the following information
Description : Server certificate validation failed with the following errors:
Certificate does not match the server name.
Certificate is from an untrusted source.
Certificate is not identified for this purpose.
Certificate is malformed.
Certificate is explicitly distrusted.
I am sure the Cert is valid however reading the following article got me thinking, https://supportforums.cisco.com/discussion/11533701/cisco-anyconnect-3008057-certificate-validation-failure.
could this be the same reason, haven't mentioned this to my customer as he is running 3.1.05. but could this be related to the same issue?
thanks in advance
Lance

I also had the problem of "no valid certificates available for authentication", although it only prompted once, rather than a flood like the OP.
However, the cause and solution for my problem was:
The certificate used for authentication was issued by my internal CA, to the Computer, NOT the user.
Although the user that is logged on is a local administrator, the AnyConnect Client application does not have the permission to send the certificate from the Computer store.
The application needs to 'run as administrator'
Right-click the application shortcut-> Properties->Compatibility->Privilege Level.
Tick ->Run This Program As Administrator.
I needed to reboot the client pc before this worked.
n.b I was using Windows 8

Anyconnect 4 - No valid certificates available. Please insert a smart card or install a valid certificate.

Hi.
I'm trying to use Anyconnect 4 as a 802.1x supplicant replacement.
I'm trying to make a profile with Anyconnect Profile Editor, where the settings are WPA2 Enterprise where both machine and user must use certificates.
I have downloaded the CA certificate from my Certificate Server, converted it to PEM and loaded it into the Profile Editor.
But when I try to use the generated configuration.xml, I get this error:
No valid certificates available. Please insert a smart card or install a valid certificate.
If I load the xml file into Notepad++ I see that the certificate path is set to the path on the hard drive where I loaded it from, ie. D:\Certificate.pem
Shouldn't that point to the Certificate Store instead?
But even if I correct the path to something on the local hard drive, I still get the same error.
So, any tips on how to use the Profile Editor correctly?
Thank you.

Hi,
I looked at the website and can see that the Classic TPC card is supported on Vista. It is the 'Java-card based solution'. What do you mean when you say that I 'might need to obtain the software using BaseCSP to enumerate the certificates'? Windows 7 can enumerate
them.
I am having the exact same problem as you however can't even login to Win7.
Did you ever find a fix for this?

Adobe Air Apps for OS X: Unable to build a valid certificate chain for the signer. // Code Signing on OS X 10.10 Yosemite

Hi,
I created several OS X Apps using Adobe Air. That worked quite well before. Now I have do update my OS X Apps - therefore I also needed update my certificates. [ I'm using Flash CC 2014 on OS X Yosemite 10.10 ]. But whatever I do it doesn’t work anymore. I always get this Message saying:
Unable to build a valid certificate chain for the signer.
I googled a lot and the only "guide" I found is this post (from April 2013) about code singing - http://scottgaertner.com/code_signing/
I’m not used to deal with this kind of stuff (CA etc.) - so it's quite confusing to me.
Would anybody please be so kind and tell me what I have to do?
Is there any instruction from Adobe? (I didn't find one yet)
A step by step instruction for absolute dummies would be great!
Best regards and thank you in advance
Jan

Hi Mukesh,
I installed the Flash CC 2014 update and added some Certificates from Apple to my Keychain. Now EVERYTHING works fine again!! :-)
Thank you very much for the Update! :-) Good job!
Best regards
Jan

Error message generating Adobe Air output Unable to build a valid certificate chain for the signer

error message generating Adobe Air Output: Unable to build a valid certificate chain for the signer.

Are you talking about AIR Help produced by RoboHelp or an AIR application that you are creating?
If the latter, please see the notice at http://forums.adobe.com/community/robohelp/airhelp
If you are using RoboHelp, which version?
See www.grainge.org for RoboHelp and Authoring tips
@petergrainge

Code signing cert error using Digicert - Unable to build a valid certificate chain for the signer

Steps to fix this error on code signing adobe air using .p12 cert from Digicert - Unable to build a valid certificate chain for the signer
a. Open Firefox and browse to https://www.digicert.com/digicert-root-certificates.htm
b. On the middle of the page, download -
DigiCert Assured ID Code Signing CA-1
Valid until: 10/Feb/2026
Serial #: 07:F4:73:6F:AF:EF:40:8A:1F:66:40:F2:65:D1:0A:C1
Thumbprint: B170A10819BEA936905D719E643399783E1F4567
Download
c. Install the cert in Firefox
d. Once done, export again the code signing cert from digicert, through (click Firefox -> Preferences -> View Certificates -> HIghlight the digicert code signing cert -> click Backup)
e. Done, the newly exported file should now have the valid certificate chain and that should fix the error "Unable to build a valid certificate chain for the signer"
Even though this is from Digicert, this should also work for other Certificate Authority providers assuming you download your provider's root cert for code signing.
Regards,
Reigner S. Yrastorza

Are you talking about AIR Help produced by RoboHelp or an AIR application that you are creating?
If the latter, please see the notice at http://forums.adobe.com/community/robohelp/airhelp
If you are using RoboHelp, which version?
See www.grainge.org for RoboHelp and Authoring tips
@petergrainge

Unable to build a valid certificate chain for the signer

Updating an AIR application after a few years and needed a new signing certificate which I purchased from Comodo. Imported it successfully into Keychain Access and exported it as a pfx file. When I identified this certificate to Flash Builder it went all the way through the build process and then came up with the error "Unable to build a valid certificate chain for the signer".
I can see there was a discussion on this matter in October 2011 but this did not seem to answer my question as that guy was trying to use an Apple Dev Centre key rather than paying for one like I did.
TIA
David

In Keychain Access, command-click your Class 2/3 certificate, the CA's intermediate certificate, and the CA's root certificate before hitting export.
Short guide: Code Signing Certificates for Adobe Air in OS X

Error creating AIR file: Unable to build a valid certificate chain for the signer.

Hi, My boss got a certificate from Thawte, and I'm getting this error message when building my AIR app.
Error creating AIR file: Unable to build a valid certificate chain for the signer.
I'm on windows XP.
thanks,
steve

To manage your code signing certificate, please see
http://www.adobe.com/devnet/air/articles/signing_air_applications_print.html
The error you are seeing is typically caused by exporting a cert without the trust chain. On Windows, in IE, you can manage your keystore by going to
Internet Options > Content > Certificates
When you export the certificate needed for signing your app, be sure to check “Include all certificates in the certificate path, if possible”.

SSL: how to use Multiple Private key/Certificate pair for authentication.

Hi all,
i am implementing SSL in java using X509 Certificate/private key combination.
i have two set of private key/certificate pair.
one is factory default and another is generated at run time.
my problem is to try ssl connection with both pairs on same tcp/ip connection.
e.g. on server side: first try ssl connection with factory default certificate, if it fails try connecting with generated certificate on same tcp/ip connection.
on client side: if generated certificate(this certificate was generated at server side) is present first perform server authentication using this certificate otherwise authenticate server with factory default certificate.
can someone please help and let me know how do i need to configure both ends(client and server) for achieving the same.
Thanks In Advance
Saurabh Ahuja

Client code does not contain any default truststore and needs a certificate for authentication.Of course it does. OpenSSL has a way of doing that: some kind of equivalent for the truststore. None of the stuff you've posted here about generating certificates at runtime has any bearing on that problem.
It's like this. The idea of PKI with SSL is as follows:
- the server has a private key and a signed certificate. Preferably it's signed by a CA that the client already trusts, otherwise if it's self-signed it has to be exported from the server's keystore and imported into the truststores of all the clients.
- the client has a truststore that trusts the server, one way or the other, see above.
- the server's private key is private to it. Nobody else has it. Nobody else can ever get it. If it ever leaks, the server is compromised, and server authentication via that private key now means absolutely nothing. You have lost security.
- the server sends its cert to the client along with a digital signature signed by its private key.
- the client (a) decides whether it trusts the cert, via its truststore, and (b) verifies the digital signature, which establishes that the server owns the certificate.
At this point the server is authenticated to the client and the SSL connection is open. It can now be used as an ordinary socket connection.
If you want client authentication too, you need all the above in reverse as well, i.e. reading server for client and client for server throughout. Note particularly that each client must have its own private key. Otherwise the private key isn't private, so signing something with it doesn't establish ownership, so client authentication isn't valid.
You need to understand all this stuff and relate it to the apparently broken security design of your application. Generating a private key and a certificate at runtime is complete nonsense within the context of PKI and SSL. It proves nothing, establishes nothing, authenticates nothing; it just wastes time.

Cisco anyconnect 3.1 - Certificate Validation Failure.

When i try to start a SSL VPN connection to the ASA(8.4) with anyconnect 3.1, Cisco anyconnect receives a message saying "No Valid Certificates Available for Authentication".
Prior to the test;
     On the ASA, i have obtain CA certificate and its identity certificate. (Both certificates obtain from windows 2008 CA).
          * ASA identity certificate's have EKU attribute = Server Authentication,   Key Usage = Digital Signature, Key Encipherment.
     On the PC in which anyconnect installed, i have obtain User Certificate (this User certificate also obtain from the same windows 2008 CA)
          * Prior to obtaining User certificate from the windows2008 CA, ASA acts as a SCEP proxy onbehalf of the client PC.
          * User Certificate's has EKU attribute = Client Authentication.
As in the ASDM Logs, it almost work.
In days of troubleshooting, i still could not find the cause of this problem. Error message as appeared on anyconnect;
Is there anyone could help.???
Keshara from Sri Lanka.

Just run into this as well. We have CRL checking turned on. Turned out to be the CRL server was down. But that was the same message I got when the client wouldn't connect.

Problem witch Anyconnect - Reading computer certificate

Hi everyone.
We are having an issue with our Windows 8.1 domain computer and Anyconnect.
We have deployed computer certificates to all our domain computers, and use them for our wireless networks, which works great.
When Anyconnect is started as a domain user, it wont allow us to connect using the machine certificate. We get an error message saying: "Certificate validation failure" and the message history says: "No valid certificates available for authentication".
If we run anyconnect as an administrator, there are no problems, and the connection is established right away.
We have tried giving domain users read access to: HKLM\software\microsoft\systemcertificates, but it didn´t help.
We have tested the same setup on OSX Yosemite, and there it works fine.
We have had succes deploying a user certificate to the user(Windows 8.1), but we will prefer using the computer certificate.
Any ideas? If you need more information, please let me know.
Best Regards

From: http://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect31/administration/guide/anyconnectadmin31/ac03vpn.html
"In the Preferences (Part 1) pane of Profile Editor, use the Certificate Store list box to configure in which certificate store AnyConnect searches for certificates. Use the Certificate Store Override checkbox to allow AnyConnect to search the machine certificate store for users with non-administrative privileges."
Rob.

Unable to build valid certificate chain

Hi,
I am trying to sign my AIR application using the Code Signing Certificate I got from Apple (iPhone Dev). I have Apple's Root Certificate and my certificate. I installed both and then exported my certificate as pkcs12 (.p12 file) using many methods like Windows Certificate Manager and Firefox. I also used Keychain Access on my Mac. However, when I try to sign, I get the following error:
Unable to build a valid certificate chain for the signer.
Some help would be great. Thanks.

Ok, I am making progress here.
I signed on to a fresh mac with an empty keychain. I imported AppleWWDRCA and then developer_identity. Now it shows that the certificate is valid. Now I deleted the certificate and I imported cert.p12 file that I had made. Now the certificate re-appeared in keychain along with a private key. I had to put a password set by me earlier when I made the p12 file.
The certificate is displayed under my private key. So it means that the p12 file has the private key and the certificate.
Now the only thing is that AIR gives me the error stating that it cannot build a certificate chain, which means there's no Root CA in the p12 file, or WWDRCA for that matter. From what I understand, these 2 certs need to be put inside the p12 file.
On second note, Apple also provides a distribution cert besides the developer cert. But when I try to export the distribution cert, it asks for a password that I don't know (not got one for that). But I still think that I need to use the developer cert. nd not the distribution cert. by Apple.
The question again boils down to putting the Apple Root CA inside the p12 in order for AIR SDK to build the chain.

Bug 2.1: Export to Excel fails: no valid colums available...

Hello,
I read some threads about the error
No valid columns available for export,
we do not currently support clob or blob columnsand none of the workarounds work for me
[Create View|http://forums.oracle.com/forums/thread.jspa?messageID=3829495]: I only have a read only user without any permissions
[Scroll Count Cancel|http://forums.oracle.com/forums/thread.jspa?messageID=3829495]
[(Re)Activate Completion Insight|http://forums.oracle.com/forums/thread.jspa?messageID=3821718]
[No dblink|http://forums.oracle.com/forums/thread.jspa?messageID=3896095]
My query has only NUMBER and VARCHAR2 as results and 1200 rows.
Log says WARNING     34     10656
oracle.dbtools.raptor.dialogs.actions.TableExportAction     oracle.dbtools.parser.plsql.TabCol.getTableNodes(TabCol.java:293)The export works in 1.2, does not work in 1.5.5 (with message "WARNING     29     17954     oracle.dbtools.raptor.dialogs.actions.TableExportAction     oracle.dbtools.parser.TabCol.getTableNodes(TabCol.java:275)"
Add: I played around with the query: the export fails when the query is like
SELECT col1
      ,(SELECT something
        FROM   whatever
       ) AS col2
FROM   some_table;while the following works
SELECT col1
      ,col2
FROM   some_table;Regards
Marcus
Edited by: Marwim on 22.12.2009 15:35

Filed
Bug 9246364 - otn: export to xls is not working for a query
-Raghu

Mail and SMTP server settings of ASA Certificate Authority for cisco anyconnect VPN

Dear All,
i have the folloing case :
i am using ASA as Certificate authority for cisco anyconnect VPN users,the authentication happens based on the local database of the ASA,
i want to issue a new certificate every 72 hours for the users ,and i want to send the one time password via email to each user.
so what the setting of the mail and smtp server should be ,
was i understand i should put my smtp server ip address then i have to create the local users again under(Remte VPN VPN--Certificate management--Local certificate authority --Manage user Database) along with their email addresses to send the one time passsword to them via their emails.
i sent the email manually ,hwo can automate sending the OTP to our VPN users automatically vi their emails?
Best regards,

Thanks Jennifer.
I did manage to configure LDAP attribute map to the specific group policy.
Nevertheless, I was thinking whether I can have fixed IP address tied to individual user.
Using legacy Cisco VPN Client, I can do it using IPSEC(IKEv1) Connection profile, where I set Pre-Shared Key and Client Address Pools. Each Client Address Pools has only 1 fix IP address.
Example: let say my username is LLH.
Connection Profile for me is : LLH-Connection-Profile, my profile is protected by preshared key.
Client Address Pool for me is : LLH-pool, and the IP is 172.16.1.11
Only me know the preshared key and only me can login with my Connection Profile.
Using AnyConnect, I have problem. User can use any connection profile because I cannot set preshared key for AnyConnect. In that case, I cannot control who can use my Connection Profile and pretend to be me.
Example:
AnyConnect Connection Profile for me is : LLH-Connection-Profile, without any password
Client Address Pool for me is : LLH-pool, IP is 172.16.1.11
Any body can use LLH-Connection-Profile, login with another user name, let say user-abc which is a valid user in LDAP server. In that case, ASA assign 172.16.1.11 to user-abc and this user-abc can access server which only allow my IP to access.
I hope above description can paint the scenario clearer.
Thanks in advance for all the help and comment given.

Valid size not available for this creation when using Greeting Card feature

Using PSE9 with a Mac. When attempting to create a greeting card, after selecting the photo, the Greeting Card, I receive a pop up error message as follows:
"Valid Size Not Available For This Creation". (All other Create functions such as Photo Book, Photo Calendar, and Photo Collage appear to be working). I have been in contact with Adobe Support and have been instructed to do a number of things from creating a new preferences file to uninstalling and re-installing the PSE software, with no result. Has anyone else run into this problem, and if so have found a fix? Thanks.

I've been tearing my hair out over this one also. I've been on hold for over 10 hrs with Adobe Support waited over almost 2 weeks and still no resolution. I'm trying to create the Save the Date cards for my wedding and I can't wait for Adobe. Removing the preferences file and uninstalling/reinstalling does not fix the problem.
That said I did figure out a workaround for this. It's easy but it does require Windows. For me this was no big deal as I do own a Windows box.
Get the free trial version of PE9 for Windows and install it. If you don't have a Windows computer get to a friend that has one
Upload some of your photos to the PE9 Windows Organizer (it's identical to the mac version)
Select Create and then Greeting card. Photoshop will launch the guided edit feature for greeting cards.
Select the Layout feature and once you find out that you like save it as Photoshop project. Repeat this step for as many layouts as necessary.
Copy your Photoshop project files (and any folders) to your mac.
Open the project files as you would with any other Photoshop file.
You can now select the Create feature. You will be able add your pictures and resize them, you will be able to add/remove text, you'll be able to change the backgound/borders, add graphics...pretty much anything...EXCEPT automatically modify the layout. If you click on Layout, PE9 returns nothing. You can however go into full edit mode and if you have decent Photoshop skills you can make any changes to the layout manually.
If I had to put money on this I'd say that there is a problem with the PE9 Mac installation package. For some reason it is not deploying the layout data/files or it is not putting them in the right place. For this reason the program can't find the layouts when the user selects the greeting card guided edit.
Good luck.

[AnyConnect] No valid certificates available for authentication

Similar Messages

Maybe you are looking for