1. convert all certs and keys to PEM format
mkdir asa
openssl x509 -in example_com.crt \
-out asa/example_com.crt -outform pem
openssl x509 -in geotrust-intermediate-ca.crt \
-out asa/geotrust-intermediate-ca.crt -outform pem
openssl rsa -in example_com.key \
-out asa/example_com.key -outform pem
2. now bundle them into PKCS12 format
cd asa
openssl pkcs12 -export -in example_com.crt -inkey example_com.key \
-certfile geotrust-intermediate-ca.crt -out example_com.p12
# remember the password when prompted to encrypt it "Enter Export Password:"
3. now base64 encode it for the ASA
( echo -----BEGIN PKCS12-----;
openssl base64 -in example_com.p12;
echo -----END PKCS12-----; ) > example_com.pkcs12
4. Import the cert on the ASA via copy/paste from example_com.pkcs12
fw1# conf t
fw1(config)# crypto ca import example_com-trustpoint pkcs12 {password}
Enter the base 64 encoded pkcs12.
End with the word "quit" on a line by itself:
-----BEGIN PKCS12-----
{ snip }
-----END PKCS12-----
quit
INFO: Import PKCS12 operation completed successfully
fw1(config)# exit
fw1# wr me
fw1# show crypto ca certificates
4. Enable the trustpoint on the outside interface
fw1# conf t
fw1(config)# ssl trust-point example_com-trustpoint outside
fw1(config)# exit
fw1# wr me
fw1# show ssl
5. Bounce the VPN
fw1# conf t
fw1(config)# webvpn
fw1(config-webvpn)# no enable outside
WARNING: Disabling webvpn removes proxy-bypass settings.
Do not overwrite the configuration file if you want to keep existing proxy-bypass commands.
INFO: WebVPN and DTLS are disabled on 'outside'.
fw1(config-webvpn)# enable outside
INFO: WebVPN and DTLS are enabled on 'outside'.
fw1(config)# exit
fw1# wr me
Here are some of the helpful pages I found to get the solution above:
http://www.cisco.com/en/US/products/ps6120/prod_configuration_examples_list.html#anchor10 http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00808b3cff.shtml https://supportforums.cisco.com/docs/DOC-13553 http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00808efbd2.shtml http://www.cisco.com/en/US/docs/security/asa/asa80/release/notes/asarn80.html#wp242704 http://www.sslshopper.com/article-most-common-openssl-commands.html http://support.citrix.com/article/CTX106630 http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00809fcf91.shtml
