anyconnect 提示“Security Warning:Untrusted VPN Server Certificate!

浏览数：71 / 时间：2015年06月20日

技术分享

出现此连接警告的原因是因为路由器上CA证书的subject-name的字段与路由器的IP地址不一致造成的。重装修改生成新的CA证书，然后连接VPN时勾选选项"always trust the vpn server and import the certifaction"后再次连接就不会再弹出该安全告警。

show run 后找到以下信息：

!
crypto pki certificate chain TP-self-signed-19124
certificate self-signed 05
3082022B 30820194 A0030201 02020105 300D0609 2A864886 F70D0101 05050030 
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274 
69666963 6174652D 31393132 34313830 3939301E 170D3135 30333034 30343436 
31335A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649 
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 39313234 
31383039 3930819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281 
8100C046 F965E4EA 7FD19E5A D31727B9 AD93DA9A EF138758 F65A9AD1 18114FE4 
A1AD404D CBB200C4 5232DCA4 892F6822 C9C9C830 41AFF407 1D4457BD 039EB24E

取消原证书

router-name(config)#no crypto pki trustpoint TP-self-signed-19124
% Removing an enrolled trustpoint will destroy all certificates
received from the related Certificate Authority.

Are you sure you want to do this? [yes/no]: yes
% Be sure to ask the CA administrator to revoke your certificates.

生成新的证书：

router-name(config)#crypto key generate rsa general-keys label router-name modulus 1024 exportable 
The name for the keys will be: router-name

% The key modulus size is 1024 bits
% Generating 1024 bit RSA keys, keys will be exportable...
[OK] (elapsed time was 0 seconds)

router-name(config)#crypto pki trustpoint router-name 
router-name(ca-trustpoint)#en
router-name(ca-trustpoint)#enrollment sel

router-name(ca-trustpoint)#enrollment selfsigned


router-name(ca-trustpoint)#rsakeypair router-name

router-name(ca-trustpoint)#subject-name 1.2.3.4
"1.2.3.4" is not a valid subject name
The subject name must be in X.500 (LDAP) format

router-name(ca-trustpoint)#subject-name cn=1.2.3.4
router-name(ca-trustpoint)#exit

router-name(config)#crypto pki enroll router-name
% Include the router serial number in the subject name? [yes/no]: no
% Include an IP address in the subject name? [no]: no
Generate Self Signed Router Certificate? [yes/no]: yes

Router Self Signed Certificate successfully created

router-name(config)#exit

router-name#conf t
router-name(config)#webvpn gateway VPNGW
router-name(config-webvpn-gateway)#ssl trustpoint router-name
router-name(config-webvpn-gateway)#exit
router-name(config)#exit

查看新生成的证书：

router-name#sh crypto pki certificates router-name
Router Self-Signed Certificate
Status: Available
Certificate Serial Number (hex): 06
Certificate Usage: General Purpose
Issuer: 
hostname=router-name.yourdomain.com
cn=1.2.3.4
Subject:
Name: router-name.yourdomain.com
hostname=router-name.yourdomain.com
cn=1.2.3.4
Validity Date: 
start date: 02:16:57 UTC Mar 9 2015
end date: 00:00:00 UTC Jan 1 2020
Associated Trustpoints: router-name