ASA AnyConnect Certificate Authentication

Cisco ASA AnyConnect VPN Certificate Authentication enhances security by providing strong, encrypted authentication while reducing reliance on passwords. It can be used as the sole authentication method for a seamless, passwordless experience or combined with password-based authentication for added security through integration with Cisco ISE or Cisco Duo.

ASA Certificate

First we need to add the Root CA Certificate to ASA, on Configuration » Remote Access VPN » CA Certificates, add the Root CA

Then we create a CSR named for the Identity Certificate “VPN-Certificate”, click add and fill in the details

And export the CSR

Sign the CSR on the Certificate Authority (CA) Server

Then install the certificate

Finally attach the certificate to the outside interface

ssl trust-point VPN-Certificate outside

ASA VPN

Here we’ll modify an existing Connection Profile to use Certificate Authentication, all needs to be done is changing the Authentication Method to “Certificate Only”

And on Advanced » Authentication, select the UPN to be used as client’s username

Client Certificate

On the client PC thats part of the domain, on Personal Certificates, create new User Certificate

The newly made certificate should be present on the Personal Certificates directory now

Now if we try accessing the ASA’s VPN Gateway, we should be asked to use our User Certificate

VPN Authentication with Certificate

Now when we try connecting to VPN, we can see that certificate will be used for authentication

And after successfully connecting, the certificate authentication details can be seen on ASA

VPN Authentication with Certificate and AAA

Other than using Certificate Only, we can also use it on top of password-based authentication, for example here we’ll also use ISE

When we connect to the VPN, the certificate will be validated first before presenting the username and password form

Invalid Certificate

If we try connecting without having a User Certificate, we’ll get an invalid certificate error

The not so cool thing is, if we export the User Certificate (along with the key) from one PC and Import it to the other PC with different user, and that PC is not even part of the domain, we will be allowed to authenticate again