0

I've site-to-site VPN connection between an ASA and multiple Cisco routers. The identity certificates need to be renewed from time to time at the CA site and I didn't have problem until now. I'm unable to import the renewed certificates with 3 of my devices:

RouterA(config)#crypto ca import Trustpoint_A certificate 

Enter the base 64 encoded certificate.
End with a blank line or the word "quit" on a line by itself

...
<renewed certificate>
....

% Failed to parse or verify imported certificate

RouterA(config)#
Aug 23 13:09:37.994: Read 960 bytes as CA certificate: 
...
<hexa>
...
Aug 23 13:09:38.102: E /users/michaelr/unpack/tk-003.commit/src/obj-4k/../cert-c/source/certobj.c(715) : Error #722h
Aug 23 13:09:38.106: CRYPTO_PKI: can not set ca cert object (0x722)
Aug 23 13:09:38.106: CRYPTO_PKI: status = 65535: failed to get key usage from cert
Aug 23 13:09:38.106: CRYPTO_PKI: status = 65535: failed to verify or insert the cert into storage

All 3 devices are Cisco 1841 with the following IOS:

  • c1841-advipservicesk9-mz.124-3i.bin x2

  • c1841-advipservicesk9-mz.124-19b.bin

I did 2 renewals with Cisco 1941 and 2821 without problems (also today). A few months before I did successful certification renewals on 3 other Cisco 1841

  • c1841-advipservicesk9-mz.124-13f.bin

  • c1841-adventerprisek9-mz.124-15.T13.bin

  • c1841-advipservicesk9-mz.124-15.T6.bin

I didn't find any abnormality in the configurations. I use quite the same setup everywhere. Do you have any idea what should I look for? Any useful debug or something to check? I don't have a clue now...

Thanks a lot!

  • Can you include the certificate please? And what IOS version are the 1941 and 2821 running? – hertitu Aug 23 '16 at 21:33
  • 1941 using c1900-universalk9-mz.SPA.151-4.M4.bin and 2821 using c2800nm-advsecurityk9-mz.124-15.T9.bin I cannot include the certificate. What would you like to check ? – human374 Aug 24 '16 at 5:43
  • You can't or you won't ? Note that it is public information, your routers send their certs to each other over the public internet every day. Anyway if you won't then can we start with openssl x509 -text -noout -in <certfile> please. – hertitu Aug 24 '16 at 6:56
  • On thing I noticed the Certification Usage seems to be wrong: At the identity cert: Certificate Usage: General Purpose; At the CA cert: Certificate Usage: Not Set – human374 Aug 24 '16 at 17:10
  • Are you importing a new CA cert as well? Is it the same as on the working routers? – hertitu Aug 24 '16 at 17:13
0

@hertitu: I didn't see any differences between the faulty and the working certs.

Finally we have performed an IOS upgrade ( to c1841-advsecurityk9-mz.124-15.T17.bin ) and this solved our problem.

| improve this answer | |
  • Weird, I did consider an IOS issue but then it seemed very unlikely that 124-13f would work and 124-13i would fail... but unlikely certainly does not mean impossible, perhaps a bug was introduced after 12.4(13)f, and fixed after 12.4(13i). Thanks for posting your solution. – hertitu Aug 30 '16 at 8:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.