I've site-to-site VPN connection between an ASA and multiple Cisco routers. The identity certificates need to be renewed from time to time at the CA site and I didn't have problem until now. I'm unable to import the renewed certificates with 3 of my devices:
RouterA(config)#crypto ca import Trustpoint_A certificate
Enter the base 64 encoded certificate.
End with a blank line or the word "quit" on a line by itself
...
<renewed certificate>
....
% Failed to parse or verify imported certificate
RouterA(config)#
Aug 23 13:09:37.994: Read 960 bytes as CA certificate:
...
<hexa>
...
Aug 23 13:09:38.102: E /users/michaelr/unpack/tk-003.commit/src/obj-4k/../cert-c/source/certobj.c(715) : Error #722h
Aug 23 13:09:38.106: CRYPTO_PKI: can not set ca cert object (0x722)
Aug 23 13:09:38.106: CRYPTO_PKI: status = 65535: failed to get key usage from cert
Aug 23 13:09:38.106: CRYPTO_PKI: status = 65535: failed to verify or insert the cert into storage
All 3 devices are Cisco 1841 with the following IOS:
c1841-advipservicesk9-mz.124-3i.bin x2
c1841-advipservicesk9-mz.124-19b.bin
I did 2 renewals with Cisco 1941 and 2821 without problems (also today). A few months before I did successful certification renewals on 3 other Cisco 1841
c1841-advipservicesk9-mz.124-13f.bin
c1841-adventerprisek9-mz.124-15.T13.bin
c1841-advipservicesk9-mz.124-15.T6.bin
I didn't find any abnormality in the configurations. I use quite the same setup everywhere. Do you have any idea what should I look for? Any useful debug or something to check? I don't have a clue now...
Thanks a lot!
openssl x509 -text -noout -in <certfile>
please.