Cert help needed, to get cisco VPN clients working

When you create a local user, UTM creates (generates) a certificate for the user, and adds it to the user account.    This is the one that you want to push out.   For your description, it sounds like you pushed out the root certificate.

===

Short summary of certificate theory.   (It is easiest to explain using an https web connection as the example.)

You ask for a web site.  DNS (or a HOSTS file) turns the name into an IP address.   You rely on multiple routers and firewalls to get the packet to the right place, and the reply back to you.   That process can be corrupted by malicious name-to-address translation, by malicious NAT address changes, by malicious routing, or by malicious packet interception.   It may not happen often, but the process is designed for the worst-case scenario.

For encryption to be meaningful, you have to be talking to the right party.   So https requires the server to send back an identity certificate.  Your browser compares the name on the certificate to the name you requested.   If they do not match, you do not have a trusted connection.

But it gets trickier.   Anybody can claim to be anything, so we need a way to decide what certificates to trust.   At the airport, they accept a government-issued ID.   They do not accept your insurance card or your (non-government) work badge.   The same applies here.   An identity certificate has to be signed by an intermediate certificate, which has to be signed by a root certificate.   What makes the root certificate trusted is that you (or somebody) chose to install it on your PC!    You trust that certificates signed by that root are legitimate.

Since root certificates are installed on your PC, there is no way to revoke them.   Intermediate certificates are used so that large masses of certificates can be revoked at once, if necessary.   Not likely to ever happen.   There can be no intermediate certificate, or more than one.   The requirement is that the certificate chain ends with a certificate installed on your PC with a "root" status assigned to it.

For the web, certificates are usually used for server authentication only.   It is perfectly possible for the server to ask you for a certificate to prove your identity as well, and your certificate better be signed by somebody the server trusts.   Depending on the security purpose, a client can be identified with a device certificate or a user certificate.   Site-to-site VPN tunnels can validate a remote device using a device certificate.   Client VPN connections would typically use a user certificate.

====

I have not used Cisco VPN client with UTM.   For UTM's SSL VPN client configuration, UTM has its own root, and issues user certificates against that root.   When the user connects back to that UTM, the UTM honors the client certificate because it was issued by its own root.   It think the Cisco client may work in a very similar way.

Hi Daniel,

If you still need help after Doug's response, please Edit your opening post and insert your images into the post instead of linking to an outside site. We can't know if that external site is properly protected. The only malware I've gotten in over 10 years was from an external link to a picture in this forum several years ago.  Thanks in advance!

Cheers - Bob

hey bob, totally understandable. I edited my post and changed a few minor details.

Semi-unrelated: the reason why I have step 1 is because my UTM isn't letting me download auto-generated userauth certs. the download button is literally broken, I have tried in 3 different browsers. But for some reason when I manually generate a cert it lets me download it. I believe this is a known bug. I'm on an SG310 running 9.510-5, hopefully the 9.6 update will release soon that fixes that.

But anyways, any insight you have to this ipad vpn problem would be appreciated.  Still having the issue no matter what combination of certificates I try. I have not yet tried the autogenerated cert for "user:ipad" for the reason above.

Daniel

I'll be back later for the main issue in this thread, but, yes 9.601 does fix the bug.  In the meantime, Modify a certificate at the command line so that it can be downloaded in WebAdmin in 9.510.

Cheers - Bob

thanks so much for this, my google searches did not turn that up. I renamed the user cert, downloaded it, and pushed it out to the iPad, which replaced the manually generated usercert that I was using before.

I also changed the server cert to an externally signed (by a CA service we use) certificate that matched the hostname that the iOS device was connecting to. Apparently that's a requirement, I was having the iPad connect to our direct IP before. That's a no-no.

I'm not sure which change fixed it, but it lit right up. You're a lifesaver! I'll mark this as solved.