Install SSL Certificate in Cisco Adaptive Security Appliance 5500

If you have not yet created a Certificate Signing Request (CSR) and ordered your certificate, see
SSL Certificate CSR Creation for Cisco ASA 5500 VPN.

Installing your SSL Certificate in the Adaptive Security Device Manager (ASDM)

For SSL Installation instructions showing the GUI, please see
Cisco ASA 5520 SSL Installation Instructions.

  1. Download your Intermediate and Primary Certificate files (the DigiCertCA.crt and your_domainname_com.crt) from your DigiCert Customer Account to the directory where you will keep your certificate files.

  2. In ASDM select "Configuration" and then "Device Management."

  3. Expand "Certificate Management" and select "CA Certificates" and then "Add."

  4. With the option selected to "Install from a file," browse to the DigiCertCA.crt file and then click the "Install Certificate" button at the bottom of the "Install Certificate" window.

    Your Intermediate (or chain) certificate file is now installed. You will now need to install the your_domainname_com.crt file.

  5. In ASDM select "Configuration" and then "Device Management."

  6. Expand "Certificate Management" and select "Identity Certificates."

  7. Select the appropriate identity certificate from when your CSR was generated (the "Issued By" field should show as not available and the "Expiry Date" field will show Pending...). Click the Install button.

  8. Browse to the appropriate identity certificate (the your_domainname_com.crt provided by DigiCert) and click "Install Certificate."

    At this point you should receive confirmation that the certificate installation was successful.

Configuring WebVPN with ASDM to Use the New SSL Certificate

  1. In ASDM select "Configuration" and then "Device Management."

  2. Click "Advanced" and then "SSL Settings."

  3. From "Certificates," choose the interface used to terminate WebVPN sessions, and then choose "Edit."

  4. From the "Certificate" drop-down, select the newly installed certificate, then "OK," and then "Apply."

    Configuring your certificate for use with the selected kind of WebVPN session is now complete.

Cisco SSL Certificates, Guides, & Tutorials

Buy Now Learn More

SSL Certificate Installation from the Cisco ASA command line (alternate installation method)

  1. From the ciscoasa(config)# line, enter the following text:

    crypto ca authenticate my.digicert.trustpoint

    Where my.digicert.trustpoint is the name of trustpoint created when your certificate request was generated.

  2. Next, enter the entire body of the DigiCertCA.crt file followed by the word "quit" on a line by itself (the DigiCertCA.crt file can be opened and edited with a standard text editor, and the entire body of that file should be entered when prompted).

  3. When asked to accept the certificate, enter "yes".

  4. When the certificate has been successfully imported, enter "exit".

    Your Intermediate (or chain) certificate file is now installed. You will now need to install the your_domainname_com.crt file.

  5. From the ciscoasa(config)# line, enter the following text:

    crypto ca import my.digicert.trustpoint certificate

    Where my.digicert.trustpoint is the name of trustpoint created when your certificate request was generated.

  6. Next, enter the entire body of the your_domainname_com.crt file followed by the word "quit" on a line by itself (the your_domainname_com.crt file can be opened and edited with a standard text editor, and the entire body of that file should be entered when prompted).

    You should then receive a message that the certificate was successfully imported.

Configuring WebVPN to Use the New SSL Certificate from the Cisco ASA command line

  1. From the ciscoasa(config)# line, enter the following text:

    ssl trust-point my.digicert.trustpoint outside

    wr mem

    Where my.digicert.trustpoint is the name of trustpoint created when your certificate request was generated and "outside" is the name of the interface being configured.

    Make sure to save the configuration.

Troubleshooting:

  1. If your web site is publicly accessible, our SSL Certificate Tester tool can help you diagnose common problems.

  2. Open a web browser and visit your site using https. It is best to test with both Internet Explorer as well as Firefox, because Firefox will give you a warning if your intermediate certificate is not installed. You should not receive any browser warnings or errors. If you immediately receive a browser message about the site not being available, then the server may not yet be listening on port 443. If your web request takes a very long time, and then times out, a firewall blocking traffic on TCP port 443 to the web server.

Installing your SSL Certificates in Cisco ASA 5500

How to install your SSL Digital Certificate on a Cisco Adaptive Security Appliance.

Related Links

SSL Certificates