Install an Identity Certificate for ASDM

http://www.cisco.com/c/en/us/td/docs/security/asdm/identity-cert/cert-install.html

Updated:July 24, 2014

Table of Contents

Install an Identity Certificate for ASDM

Run the ASDM Identity Certificate Wizard (ASDM 7.3 and Later)

Register the New Identity Certificate(s) with Java

Install an Identity Certificate for ASDM

Last Updated: May 8, 2015

When using some versions of Java, such as Version 7 update 51, the ASDM Launcher requires a trusted certificate. An easy approach to fulfill the certificate requirements is to generate a self-signed identity certificate and to configure the ASA to use it when establishing an SSL connection. After you generate the identity certificate and configure the ASA, you need to register it with the Java Control Panel on your computer.

For the ASA 5506-X, 5508-X, or 5516-X with an ASA FirePOWER module, you can use ASDM for module management. In this case, you must create two identity certificates: one for the ASA and one for the module.

Run the ASDM Identity Certificate Wizard (ASDM 7.3 and Later)

ASDM 7.3 and later provides the ASDM Identity Certificate Wizard. The wizard makes configuring self-signed identity certificates easy.

• When you first launch ASDM and do not have a trusted certificate, you are prompted to launch ASDM with Java Web Start; the certificate wizard then starts automatically.
• If you start ASDM yourself using Java Web Start, then you can launch the wizard from the Wizards menu.
• To generate the separate ASA FirePOWER module certificate, you must re-run the wizard to generate the additional certificate.

Procedure

1. Launch ASDM. Use an already installed ASDM Launcher, or connect to the ASA IP address with a browser (https:// asa_ip_address /admin) to install a new Launcher. The Launcher prompts you to automatically start ASDM with Java Web Start for the purpose of running the certificate wizard.

2. (If the wizard did not launch automatically) Choose Wizards > ASDM Identity Certificate Wizard.

3. Complete the wizard. We recommend choosing the Simple Mode option.

4. (ASA FirePOWER module) Re-run the wizard, and choose the SFR Module option.

5. Quit ASDM.

6. See Register the New Identity Certificate(s) with Java to register both certificates.

Register the New Identity Certificate(s) with Java

This procedure shows Java in Windows 7; your operating system may differ.

Procedure

1. On your computer, launch the Java Control Panel. On the Security tab, click Manage Certificates.

2. From the Certificate type drop-down list, choose Secure Site, and click Import.

Note: You must choose the Secure Site option; other categories do not work.

3. Choose the ASA certificate you earlier exported from ASDM.

4. (ASA FirePOWER module) Click Import again, and choose the module certificate that you earlier exported from ASDM.

5. Click Close.

6. You can now use the ASDM Launcher.

(ASDM 7.2 and Earlier) Manually Configure the ASA for an Identity Certificate

Complete all of the following procedures.

Create the Identity Certificate

Procedure

1. In a browser, connect to the ASA (https:// asa_ip_address /admin) and launch ASDM by clicking Run ASDM.

2. Choose Configuration > Device Management > Certificate Management > Identity Certificates, and click Add.

3. Click the Add a new identity certificate radio button, and click Select for the Certificate Subject DN.

4. From the Attribute drop-down list, choose Common Name (CN), enter the ASA IP address for the Value, click Add, and then click OK.

5. Check the Generate self-signed certificate check box and click Add Certificate.

6. Click Apply.

Export the New Certificate

Procedure

1. Select the certificate, and click Export.

2. Click Browse to choose a save location and name the certificate with the.csr extension (the Java Control Panel expects a.csr extension, so you can save yourself a step by using.csr even though this certificate is a CER file).

3. Click the PEM Format (Certificate Only) radio button, and then click Export Certificate.

Set the Certificate to Be Used with SSL

Procedure

1. Choose Device Management > Advanced > SSL Settings. In the Certificates area, select the management interface entry, and click Edit.

2. From the Primary Enrolled Certificate drop-down list, choose the newly-created certificate with the CN value of the ASA IP address, and click OK.

3. Click Apply.

4. See Register the New Identity Certificate(s) with Java.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)