Cisco ASA¶

The Cisco ASA rejects a certificate whose chain includes a CA certificate signed with SHA-1, and a certificate with an RSA key shorter than 2048 bits. Provision certificates that have a SHA-256 chain and either an ECDSA key or an RSA key of at least 2048 bits.

1. In the Certificate Manager - SaaS toolbar, click Machines.
2. Click the more options button at the right end of the Cisco ASA machine's row, and then select Provision.

3. From the Search a certificate by name, expiration, or fingerprint field, begin typing the certificate name you want to provision. Click the certificate when it appears in the list.

4. Under Certificate Information, leave Trustpoint Name as it is. The field is read-only. When Certificate Manager - SaaS installs the certificate, it names the trustpoint venafi- followed by the first 32 hexadecimal characters of the certificate's SHA-256 fingerprint, so a retry reuses the same trustpoint.

5. Leave Previous Trustpoint Name as it is. The field is read-only. When you renew a certificate, Certificate Manager - SaaS fills it in with the trustpoint this certificate replaces and removes that trustpoint after it binds the new certificate. Certificate Manager - SaaS removes only trustpoints that it created.

6. Leave Security Context as it is. The field is read-only. When Certificate Manager - SaaS installs the certificate, it fills in the machine's Security Context, or single if the machine doesn't have one.

7. Under Server Store Details, for Binding Type, choose how to bind the certificate on the Cisco ASA:

   • Management Interface: the management interface.
   • Interface: any other interface.
   • VPN Load-Balancing IP: the VPN load-balancing address on an interface, instead of the interface itself.
   • Domain (SNI): a specific fully qualified domain name (FQDN), using Server Name Indication (SNI). This binding takes precedence over interface bindings.
   • Global Fallback: used when no more specific binding matches.
   • IKEv2 Remote Access: Internet Key Exchange version 2 (IKEv2) remote-access VPN. A firewall has at most one.
   • Unbound: installs the certificate without binding it.

   Note

   When you bind to the interface that Certificate Manager - SaaS uses to manage the Cisco ASA, the firewall restarts its HTTPS listener with the new certificate. Management connectivity drops briefly, and other sessions to that interface, including ASDM, disconnect. This is expected. Certificate Manager - SaaS confirms the binding by reading the configuration back.

8. In Interface Name, enter the interface's name (nameif) as the Cisco ASA reports it in show nameif. For Domain (SNI), Global Fallback, IKEv2 Remote Access, and Unbound, enter (unbound), including the parentheses.

9. If you chose Domain (SNI), in Domain Name, enter the FQDN the certificate serves.

10. To save without pushing the certificate, disable Push certificate on save.

11. Click Save.

    Tip

    You can schedule your provisions daily, weekly, or monthly. See Set up a machine provisioning schedule.

After you save, Certificate Manager - SaaS imports the certificate, its private key, and its issuing chain into a trustpoint on the Cisco ASA. It then binds the trustpoint, saves the configuration so the change survives a reboot, and removes the trustpoint the certificate replaces. An installation appears on the Installations tab.