0

I've site-to-site VPN connection between an ASA and multiple Cisco routers. The identity certificates need to be renewed from time to time at the CA site and I didn't have problem until now. I'm unable to import the renewed certificates with 3 of my devices:

RouterA(config)#crypto ca import Trustpoint_A certificate 

Enter the base 64 encoded certificate.
End with a blank line or the word "quit" on a line by itself

...
<renewed certificate>
....

% Failed to parse or verify imported certificate

RouterA(config)#
Aug 23 13:09:37.994: Read 960 bytes as CA certificate: 
...
<hexa>
...
Aug 23 13:09:38.102: E /users/michaelr/unpack/tk-003.commit/src/obj-4k/../cert-c/source/certobj.c(715) : Error #722h
Aug 23 13:09:38.106: CRYPTO_PKI: can not set ca cert object (0x722)
Aug 23 13:09:38.106: CRYPTO_PKI: status = 65535: failed to get key usage from cert
Aug 23 13:09:38.106: CRYPTO_PKI: status = 65535: failed to verify or insert the cert into storage

All 3 devices are Cisco 1841 with the following IOS:

  • c1841-advipservicesk9-mz.124-3i.bin x2

  • c1841-advipservicesk9-mz.124-19b.bin

I did 2 renewals with Cisco 1941 and 2821 without problems (also today). A few months before I did successful certification renewals on 3 other Cisco 1841

  • c1841-advipservicesk9-mz.124-13f.bin

  • c1841-adventerprisek9-mz.124-15.T13.bin

  • c1841-advipservicesk9-mz.124-15.T6.bin

I didn't find any abnormality in the configurations. I use quite the same setup everywhere. Do you have any idea what should I look for? Any useful debug or something to check? I don't have a clue now...

Thanks a lot!

Improve this question
7
  • Can you include the certificate please? And what IOS version are the 1941 and 2821 running?
    – hertitu
    Aug 23, 2016 at 21:33
  • 1941 using c1900-universalk9-mz.SPA.151-4.M4.bin and 2821 using c2800nm-advsecurityk9-mz.124-15.T9.bin I cannot include the certificate. What would you like to check ?
    – human374
    Aug 24, 2016 at 5:43
  • You can't or you won't ? Note that it is public information, your routers send their certs to each other over the public internet every day. Anyway if you won't then can we start with openssl x509 -text -noout -in <certfile> please.
    – hertitu
    Aug 24, 2016 at 6:56
  • On thing I noticed the Certification Usage seems to be wrong: At the identity cert: Certificate Usage: General Purpose; At the CA cert: Certificate Usage: Not Set
    – human374
    Aug 24, 2016 at 17:10
  • Are you importing a new CA cert as well? Is it the same as on the working routers?
    – hertitu
    Aug 24, 2016 at 17:13

1 Answer 1

Reset to default
0

@hertitu: I didn't see any differences between the faulty and the working certs.

Finally we have performed an IOS upgrade ( to c1841-advsecurityk9-mz.124-15.T17.bin ) and this solved our problem.

Improve this answer
1
  • Weird, I did consider an IOS issue but then it seemed very unlikely that 124-13f would work and 124-13i would fail... but unlikely certainly does not mean impossible, perhaps a bug was introduced after 12.4(13)f, and fixed after 12.4(13i). Thanks for posting your solution.
    – hertitu
    Aug 30, 2016 at 8:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.