WebVPN-Problem with Digital Certificate and AAA

Hello everyone,
I have a problem during configuring WebVPN on ASA 5520 using AAA and digital certificate of Microsoft. (MSCEP)
Currently, The WebVPN service is enabled and it worked well with AAA (local or external) only,
But now, I want to use both AAA and Certificate for most secure-I mean that the users will be authenticated 2 times (firstly, it is checked by valid certificate then user/pass is second one).
Here are details:
I tried installation CA server (Microsoft CA service combined with SCEP) and register ASA with CA server (ASA work as subordinate CA)-->these steps is ok, asa has registed, then client use web-browser request CA and it's issued by CA administrator then it is installed on web-browser.
Testing:
The Client tried to test with access SSL VPN, the welcome WEBVPN message prompt user/pass but the message is "Logon Failed" before I give user and pass,
Does anyone know and advise ?
Thanks
Khanh

Hi all,
Here are attach files for my issuse,
Khanh

Similar Messages

After last updating for OS 10.7.2 problems with digital certificate

Hi everybody,
Im having problems with lion after last updating yesterday... The digital certificates dont more work!!! In time: the same certificates still work in to snow leopard...
I exported from snow leopard and imported on lion, but nothing.
Until the keychain GUI aborted after that import... Just surfing on HTTPS page with that certificate and safari aborted too.
Some ideia? i id send reports to Apple... but I dont have hope to answer.
To test with version 10.7.2, please access https://www.caixa.gov.br
Thanks
Roberto Malheiro

Assuming that the HP software is up-to-date, but still not working, have you tried Image Capture in the Applications folder. Does that work?

Problem with digital output and microph

Hello! I recently bought a new motherboard MSI K8N SLI Platinum that have onboard Sounblaster Li've 24bit, with coaxial and spdif and also the standard outputs. I ve connected via a fiber optical cable to my amplifier and i checked the digital output only box to the advanced settings on the mixer. I am hearing sound very well from my amplifier but when i connect headphones to with microphone to my soundcard , i don't hear anything at all from my headphones. Also i cannot speak via microphone. If i uncheck the box digital output only i hear sound from my headphones and also i can speak to microphone. Is there some way to have them both enabled? In my previous motherboard i didn't have that problem. I could hear sound from my amplifier with pcm signal and from my headphones and microphone analog at the same time.
Thanks!

Thibaud,
The clue is here: " i take acquisition with one sample on demand."
You are apparently using software timed output. To maintain accurate phasing at 80 Hz you need timing which is accurate to better than 4 milliseconds. This is not likely to occur with a desktop operating system. Sometimes it will be good and other times OS latencies will throw the timing way off.
If your board supports it, use hardware timing. The timebase sources on most boards are far more precise and accurate than software timing.
Lynn

Having some problems with security certificates

Hello,
In some pages, e.g. Twitter, and pages that load FB comments sections, I'm having problems with the certificates and the pages won't load. I don't get an option to add an exception either, therefore I cannot access pages.
I have pasted the error details below. Here is some important info for you:
Version: 9.0.1 <-- Upgrading is NOT an option, this is a corporate machine
Connect via proxy: yes
I doubt very much that this is an issue with the connection, as IE and Chrome are NOT having this issue on the same connection.
Error I get:
This Connection is Untrusted
You have asked Firefox to connect securely to twitter.com, but we can't confirm that your connection is secure.
Normally, when you try to connect securely, sites will present trusted identification to prove that you are going to the right place. However, this site's identity can't be verified.
What Should I Do?
If you usually connect to this site without problems, this error could mean that someone is
trying to impersonate the site, and you shouldn't continue.
Technical Details
twitter.com uses an invalid security certificate.
The certificate is not trusted because the issuer certificate is not trusted.
(Error code: sec_error_untrusted_issuer)
Can anyone shed some light? The usual troubleshooting I've come across hasn't helped me much.

Off the cuff it smells of a man-in-the-middle situation to me. As far as I know, Twitter does have a valid certificate, signed by Verisign. That IE and Chrome have no problem with it, could just mean they do not check resp. do let you know.
I'll have to pass here, because I would not know, how to turn this checking off in FX 9.0 - in any case I would think twice before doing it. The place to look would be Options > advanced > Encryption.
Hope somebody else joins us:)
PS: keeping you nailed down to Fx 9.0 version is unsafe - not just for you, but for your company as well.

Since the most recent Firefox update 3.6.8 by banking institution no longer shows as having a secure encrypted connection, however, my bank assures me all is well with their certificates and that is a problem with the new Firefox browser update, can you g

Since the most recent Firefox update 3.6.8 my banking institution no longer shows as having a secure encrypted connection, however, my bank assures me all is well with their certificates and that is a problem with the new Firefox browser update, can you give me some idea why it is doing this?
== This happened ==
Every time Firefox opened
== Right after the new Firefox update

Hello Anne.
Can you please try it in a new (temporary) Firefox profile and see if the issue is still present? See [http://support.mozilla.com/en-US/kb/Managing+profiles this article] to know how to create a new Firefox profile. Please report back the results.

3rd party Certificate and AAA Authentication

I am using a cisco asa5520 and i have set up remote access vpn with an AnyConnect connection profile.
In the connection profile i have set up that users should authenticate using both certificate and AAA.
Due to a high security requirement, the user certificate is issued from a 3rd party.
This is working fine and the user now need a valid certificate and a username/password to authenticate successfully.
I added the CA certificate as a associated trustpoint on the ASA box to get the certificate verification working.
Problem:
If Jane and Joe both have a valid certificate AND a valid username/password, Jane could authenticate using a combo of Joes certificate, and Janes username/password. Both are valid (isolated), but i only want jane to be able to authenticate with her username/password and her personal certificate.
I got an idea that i could put the Serial Number of the users certificate on the user object in AD (on the users department field or something like that) and check if this value match during authentication.
So, to sum things up, i want to compare the Serial Number (SER) field of the users certificate with a field on the user object in AD during authentication. As far as i can see the user would need a valid certificate and a valid username/password to authenticate. The user would also be authenticated only if the serial field match the value on the user object in AD.
I am happy for any help that could point me in the right direction on how to accomplish this.
Best regards,
Kenneth

I actually got a better idea, and i think this will work great!
One of the guys at work pointed out that the sAMAAccountName is still used in many areas even though it is called pre-windows 2000.
After some trying and failing i got the idea that should try to change the "Naming Attribute(s)" on the defined AAA (ldap) server under "AAA server groups".
So i change the Naming attribute to "department", and put in the certificate serial number. I changed the connection profile and specified that it should use the "SER" value from the certificate as username. After that i tried to log in, and voila:
[123] LDAP Search:
        Base DN = [dc=Testlab,dc=local]
        Filter = [department=xxxx-xxxx-xxxxxxxxx]
        Scope   = [SUBTREE]
[123] User DN = [CN=Peter Pan,OU=Wonderland,DC=testlab,DC=local]
The ldap debug is clear, the ldap query during authentication is now searching for the user using the department field, and looking for the value of the serial number from my certificate.
I wasnt quite happy about using the "department" field and i took a look at the user object looking for a more suitable attribute. To my surprise the user has got a "serialNumber" attribute, and it can hold multiple values. I changed the "Naming Attribute(s)" from "department" to "serialNumber" and added the serial number from the certificat to the "serialNumber" attribute on the user object:
[138] LDAP Search:
        Base DN = [dc=Testlab,dc=local]
        Filter = [serialNumber=xxxx-xxxx-xxxxxxxxx]
        Scope   = [SUBTREE]
[138] User DN = [CN=Peter Pan,OU=Wonderland,DC=testlab,DC=local]
Worked like a charm!
I will settle for this solution, i cant see any issues regarding security, and it will be a breeze to admin. I will make a tool now so i can search for users in AD and update/view this attribute on the user objects.
Thank you for the input Marcin

PROBLEM WITH DIGITAL EDITIONS

Hi,
I've always encountered this problem with digital editions: Adobe Digital Editions 2.0 has encountered a problem and needs to close. We are sorry for the inconvenience.
I'm using Windows XP pro 2002, service pack2 on an old computer AMD Duron 901 Mhz , 384 mb RAM.
is there a solution ?
Thanks

Hi
I had the same problem, ADE 2 won't work with older AMD computers. See http://forums.adobe.com/thread/1081859
Older version that does work at: http://kb2.adobe.com/cps/403/kb403051/attachments/setup.exe
good luck

[SOLVED] Problem with ca-certificates

For some time there is a problem with ca-certificates during update. I receive folowing error:
[user@bragi ~]$ sudo pacman -Suy
:: Synchronizowanie baz danych z pakietami...
core jest już w najnowszej wersji
community jest już w najnowszej wersji
multilib jest już w najnowszej wersji
:: Rozpoczynanie pełnej aktualizacji systemu...
ostrzeżenie: libxml-perl: local (0.08-6) jest nowsze niż community (0.08-5)
rozwiązywanie zależności...
ostrzeżenie: nie można rozwiązać "ca-certificates-mozilla", zależności od "ca-certificates"
:: Następujący pakiet nie mógł zostać zaktualizowany w wyniku niespełnionych zależności:
ca-certificates
:: Czy chcesz pominąć powyższy pakiet przy aktualizacji? [t/N] N
błąd: nie udało się przygotować transakcji (niespodziewany błąd)
I know that this is not in english but the messages says that there is a error with dependency ca-certificates-mozilla <--> ca-certificates.
I ask this same question on polish forum but I only receive suggestion to try run:
pacman -Suyy
but this is not a solution.
Any ideas?
Last edited by web01 (2014-10-16 19:36:30)

I'm not sure but maybe becouse of this
[user@bragi ~]$ sudo pacman -Suyy
:: Synchronizing package databases...
core 116.7 KiB 1945K/s 00:00 [#####################################################] 100%
extra 1767.3 KiB 2.16M/s 00:01 [#####################################################] 100%
community 2.3 MiB 2.28M/s 00:01 [#####################################################] 100%
multilib 118.9 KiB 2.04M/s 00:00 [#####################################################] 100%
:: Starting full system upgrade...
:: Replace ati-dri with extra/mesa-dri? [Y/n]
:: Replace baloo with extra/baloo4? [Y/n]
:: Replace baloo-widgets with extra/baloo4-widgets? [Y/n]
:: Replace grantlee with extra/grantlee-qt4? [Y/n]
:: Replace intel-dri with extra/mesa-dri? [Y/n]
:: Replace java-common with extra/java-runtime-common? [Y/n]
:: Replace kfilemetadata-frameworks with extra/kfilemetadata5? [Y/n]
warning: libxml-perl: local (0.08-6) is newer than community (0.08-5)
:: Replace nouveau-dri with extra/mesa-dri? [Y/n]
:: Replace svga-dri with extra/mesa-dri? [Y/n]
resolving dependencies...
looking for inter-conflicts...
error: unresolvable package conflicts detected
error: failed to prepare transaction (conflicting dependencies)
:: kwin and kdebase-workspace are in conflict

Getting error "Problem with SSL Certificate" but I'm connecting to my private server without SSL

I wanted to create a PDF from a subtree at a website. The first problem was that Acrobat Pro (11.0.7) wouldn't spider it (probably because there was a robot.txt file there) so I had to use SiteSucker to pull the pages down to my Mac.
Then I discovered that Acrobat Pro can't handle file:/// URLs so that was no good either
So then I copied all the pages to a folder on my Linux server where I use a non-standard port (86) for http connection as a minor security precaution.
When I tried to access that from Acrobat Pro, it bitched about a problem with SSL Certificate but gave me no option to do anything about it. More relevantly, all the files were accessible using http protocol, not https so there shouldn't have been any need to deal with SSL certificates at all
I had to temporarily enable port 80 on my apache server at which point it's now pulling all the files in and hopefully converting them.
A) We're at version 11 ---- these kinds of issues should have been fixed years ago
B) While you're at it, fix the stupid UI issue where the download dialog disappears completely if Acrobat Pro doesn't have the focus. On a long download, I'd like to be able to see progress while working on other stuff. Acrobat Pro is not the center of the universe!

Interesting point 2, I am working on a Mac plugin at the moment. It does not hide its dialogs when switching to a different app. I consider this a bug and will fix it so the dialog disappears. I hadn't considered the question of progress but there is a very strong reason to do this on the Mac.
My tests seem to show that
(a) to get a dialog to sit above PDF documents all the time, it must be on a higher "level".
(b) if a dialog is at a higher level, this is a global setting.
So, if the dialog is not hidden when switching all, it will typically sit on top of the other app's document windows. This would not be popular, as the end user, unless they have mountains of screen space and choose to use it that way, must either close or move the dialog when switching app, then bring the dialog back. So, because Acrobat Pro is not the centre of the universe, it will hide dialogs (or rather, the Mac will, as it's a standard option when creating a window).

Problem with Digital Signature strategy in Document Managment System

Hello ALL,
I am facing problem with Digital Signature strategy in DMS. If any help its greatly appreciated.
I have senario where Approvers in DMS will review the document and approve the document and put on their digitial signature. if i have multiple approvers maintained in the characterstics it has to check weather it has been approved by all approvers otherwise it has to reset the status to for approval.
My problem is i am able to reset the status back from approved to for approval using the badi document_status01 but when the next approver logs in to the document and change the status to approved he is not able to get the digital signature pop up which it comes only first user approves it.
can any one help me out on whats going wrong in it.
Thanks
Srikanth Aduri.

Hi,
maybe the reason for this is that the status of the digital signature is not changed. Then the system thinks that the digital signature is still completed and therefore the user is not getting the pop-up again. The database table for the digital signature for documents is TC77. I hope this information is usefull for you.
Best regards,
Christoph

How to access 802.1x authentication wired nework with digital certificate?

How can I access 802.1x authentication wired network with digital certificate?
I can access the network in windows with the following configutaion:
BUT in my lion, I had import the digital certifacte. While I connected to the network, I was prompted:
Enter the name and password for this 802.1X network
I could not get the opportunity to select my digital certificate? But my colleague can.
iPhone Configuration Utility seemed to provide wireless 802.1X authentication configuration file . And in my work background, most people use the windows. And there isnot a lion server to provide a configuration file.

Dear Rune,
Thank you for reaching Small Business Support Community.
If you have already followed the 802.1X Supplicant configuration described in page 112, chapter 6, on the admin guide;
http://www.cisco.com/en/US/docs/wireless/access_point/csbap/wap121/administration/guide/WAP121_321_AG_en.pdf
All I can suggest you is to make sure you are running on the latest firmware release version 1.0.4.2;
http://software.cisco.com/download/release.html?mdfid=284152656&flowid=32563&softwareid=282463166&release=1.0.4.2&relind=AVAILABLE&rellifecycle=&reltype=latest
And then contact the Small Business Support Center to have a TAC engineer figure this out;
https://www.cisco.com/en/US/support/tsd_cisco_small_business_support_center_contacts.html
Please do not hesitate to reach me back if there is anything I may assist you with in the meantime.
Kind regards,
Jeffrey Rodriguez S. .:|:.:|:.
Cisco Customer Support Engineer
*Please rate the Post so other will know when an answer has been found.

Problems with ListViews Drag and Drop

I'm surprised that there isn't an Active X control that can do this more
easily? Would
be curious to find out if there is - although we aren't really embracing the
use of
them within Forte because it locks you into the Microsoft arena.
---------------------- Forwarded by Peggy Lynn Adrian/AM/LLY on 02/03/98 01:33
PM ---------------------------
"Stokesbary, Michael" <[email protected]> on 02/03/98 12:19:52 PM
Please respond to "Stokesbary, Michael" <[email protected]>
To: "'[email protected]'" <[email protected]>
cc:
Subject: Problems with ListViews Drag and Drop
I am just curious as to other people's experiences with the ListView
widget when elements in it are set to be draggable. In particular, I am
currently trying to design an interface that looks a lot like Windows
Explorer where a TreeView resides on the left side of the window and a
ListView resides on the right side. Upon double clicking on the
ListView, if the current node that was clicked on was a folder, then the
TreeView expands this folder and the contents are then displayed in the
ListView, otherwise, it was a file and it is brought up in Microsoft
Word. All this works great if I don't have the elements in the ListView
widget set to be draggable. If they are set to be draggable, then I am
finding that the DoubleClick event seems to get registered twice along
with the ObjectDrop event. This is not good because if I double click
and the current node is a folder, then it will expand this folder in the
TreeView, display the contents in the ListView, grab the node that is
now displayed where that node used to be displayed and run the events
for that as well. What this means, is that if this is a file, then Word
is just launched and no big deal. Unfortunately, if this happens to be
another directory, then the previous directory is dropped into this
current directory and a recursive copy gets performed, giving me one
heck of a deep directory tree for that folder.
Has anybody else seen this, or am I the only lucky one to experience.
If need be, I do have this exported in a .pex file if anybody needs to
look at it more closely.
Thanks in advance.
Michael Stokesbary
Software Engineer
GTE Government Systems Corporation
tel: (650) 966-2975
e-mail: [email protected]

here is the required code....
private static class TreeDragGestureListener implements DragGestureListener {
     public void dragGestureRecognized(DragGestureEvent dragGestureEvent) {
     // Can only drag leafs
     JTree tree = (JTree) dragGestureEvent.getComponent();
     TreePath path = tree.getSelectionPath();
     if (path == null) {
          // Nothing selected, nothing to drag
          System.out.println("Nothing selected - beep");
          tree.getToolkit().beep();
     } else {
          DefaultMutableTreeNode selection = (DefaultMutableTreeNode) path
               .getLastPathComponent();
          if (selection.isLeaf()) {
          TransferableTreeNode node = new TransferableTreeNode(
               selection);
          dragGestureEvent.startDrag(DragSource.DefaultCopyDrop,
               node, new MyDragSourceListener());
          } else {
          System.out.println("Not a leaf - beep");
          tree.getToolkit().beep();
}

Problems with Customer Service AND unexplained charges!

I've been with Verizon for I-don't-know-how-many years, and through the years you are bound to have a few problems here and there but some of the problems are just ridiculous! It's also the same reocurring problem!!!!!!!!!!!!!!!! I was with Alltel first, before it was bought out by Verizon. The years I was with Alltel, I didn't have near as many problems. It seems EVERY time I do the smallest change or something to my phone or bill, I get a ridiculous amount of charges that I was NOT aware of, nor told about... EVEN IF I ask "So this isn't going to change my bill, or there will not be any unexpected/unexplained charges that I don't know about?"... BUT not matter how many times I ask... and NO matter how many times I am told "no"... there always is. For example.... last year, I updated and signed a new 2 year contract and purchased the first Driod. Before, my 30 day warranty was up, I was having problems with my Driod, and decided to send it in and get a new one. Before I did this.. I called customer service to make sure there would be no interuption in my bill, and there wouldn't be any unexpect charges, and there would be no difference in anything. I was told there was not, and once I recieved my new phone, just send it in and nothing would be changed. Of course, when I get my bill.. I see I was charged $500 for the new phone. It was explained to me that my credit card was reimbursed (which I never check that card, because I never used it expect to purchase the phone) and that I was recharged for the new phone, since it was a new phone. So I had to fork out the $500 (on top of my bill) and then wait months to get the $100 rebate card. Months after that, I "assumed liablity of my line" because I was on a plan with my family. I decided to have my own line, so I "assumed liability." I was not told that when I did that, I "renewed" my contract date. So I just added 6 more months to my 2 year contract. Was NOT told about that! Then again...... I was recently having problems with my Driod (the screen went black and would not come back on.) I had to turn on an OLD motorola razor, so I would not be without a phone for two days while I was waiting on my phone to come in. As soon as my phone came in, I had my Droid turned back on. I recieved my bill recently, and my bill was $200 over what it normally should be.... so I called in... apparently, when I had my phone replaced, they dropped off my data package and when I recieved my replacement driod, they never put it back on. So I was being charged for alllll my data usage... again I was NOT told about this. I wasn't even aware that they had dropped off my data package, and when/where did they get the authority to do that??? These are just a FEW of the problems that I have had.................................
Does anyone have these reoccuring problems!?

I understand that my bill can be viewed online, and I do view it fairly regularly, so if there are any unexplained charges, I can call Verizon asap. The problem does not come from me not understanding my bill, but from customer service. I have been with Verizon for a very long time, and it is a continuing problem. Where did Verizon get the 'OK' to drop my data package off my plan? Who authorized that?
After calling Verizon and trying to find out the problem, the gentleman told me that when I activated on old phone while I was waiting on my new Droid to arrive, my data package was dropped off and I "should" have been told about that. When I reactiviated my new Droid, I "should" have called and had them restart my data package. I was not aware that when you activate an old phone that data plan is taken off your plan. In all my years of having cell phones, I never make two years with one phone. I have always, at one point, had to turn on an old phone, and my data package has NEVER changed. Why would I have my data package dropped and why would I have to call Verizon to have it restarted. I would never know to do that unless I was TOLD that my data packaged HAD to be re-added when I recieved my new phone, but I was never told of that.
All of that is beside the point, the point is, Verizon was never given the authorization to change my plan. Never. My bill was taken care of and readjusted, and I am thankful for that. It does not change the fact it is always a hassle with Verizon Customer Service and I am always the one having to PROVE that I am not at fault, or that I was NEVER told of certian things. EVERY TIME I HAVE CALLED CUSTOMER SERVICE, I AM TOLD "I'M SORRY, THEY SHOULD HAVE TOLD YOU THAT."
"they should" does not help my bill with the extra armount of charges.

Problems with dropped calls and no reception on Samsung Continuum

My mother and I both purchased a Samsung Continuum in late March 2011, and have experienced the same problems with the phone. The device drops at least 2-3 calls per day, often on the same conversation; we have not found that location or time of day makes a difference. The phone freezes up frequently, even if no apps are running in the background. We lose our 3G network reception frequently, and cannot access our texts, emails, or the internet. The screen saver kicks in even when we are actively dialing a number, or typing in a text message. The overall performance of the phone is also poor, and it is quite slow much of the time.
We have raised this issue several times with a representative at one of the Verizon stores, but he states that he can find no problem with the phone, and that these issues may not be covered under our insurance plan. None of my friends with non-Samsung phones are having the same problems with phone reception and performance. I am aggravated enough with these issues that I am considering reactivating my old Blackberry, which worked like a charm.
I am not upset that my phone has not been updated to Android 2.2. I just want the phone to perform as stated, and not fail at its primary function: making and receiving phone calls. I am not certain if these problems originate with the phone, Verizon, or Samsung, nor do I care. I just want to resolve these issues as soon as possible, or I will have to look at other alternatives.
Thank you.

If this doesn't work...now what??? I have a useless $400 plus piece of unreliable junk. My Motorola Razor was ions more reliable than this phone...very, very sad but true.
What carrier were you using with the Razor? AT&T? Same area?
Dave M.
MacOSG Founder/Ambassador  An Apple User Group  iTunes: MacOSG Podcast
Creator of 'Mac611 - Mobile Mac Support' (designed exclusively for an iPhone/iPod touch)

Problems with Mail, Safari and iTunes after updating to 10.5.6

Hi all,
after installing 10.5.6 I have problems with Mail, Safari and iTunes.
The time to open mails, websides and iTunes store is increasing dramatically since the update. If I open a webside parallel with Safari and Firefox, Safari needs minimum 15 times longer to open the complete side. Mails containing HTML-code also needs a long time to be opened. Tha same Problem with iTunes store. Connecting to the Store costs at least 30 - 40 seconds. And unfortunately for every iTunes store side I open. Its terrible
Any idea or workaroung to solve that problem?
Regards
Michael

First, run Disk Utility and repair permissions and then restart.
I installed the 10.5.6 Combo update. Sometimes things get "lost in the translation" when you use Software Update depending on your installation. Perhaps you can download 10.5.6 Combo from the website and install it from your desktop.

WebVPN-Problem with Digital Certificate and AAA

Similar Messages

Maybe you are looking for