将 cisco Anyconnect 与 pfx 证书结合使用时证书验证失败

Question

我已经安装了 cisco anyconnect 安全移动客户端 4.2.01022（+所有必需的软件包）。

然后将.pfx证书添加到gnone2-key存储中。

然后我启动了 cisco anyconnect 安全移动客户端，输入连接位置 - 但 cisco 一直这样告诉我Certificate validation failure

尝试过这个：

sudo cp /etc/ssl/certs/Global* /opt/.cisco/certificates/ca

链接已创建但没有帮助。如何连接？

更新：

这样我就提取了一些不同格式的证书：

openssl pkcs12 -in store.pfx -clcerts -nokeys -out domain.cer
openssl pkcs12 -in store.pfx -nocerts -nodes  -out domain.key
openssl pkcs12 -in store.pfx -out domain.crt -nodes -nokeys -cacerts
openssl pkcs12 -in  store.pfx  -nocerts -out domain.pem -nodes

得到4个文件：

domain.cer
domain.key
domain.crt
domain.pem

将所有 4 个放在 3 个不同的位置：

~/.cisco/certificates/ca ~

受信任的 CA 和根证书

~/.cisco/certificates/client

客户证书

~/.cisco/certificates/client/private

私钥

同样的错误。

UPD2：尝试配置与openconnect（集成到linux网络中心）兼容的cisco anyconnect：它要求设置：

CA certificate (it has to be domain.crt, so chosen it)
User certificate  (that is it? - didnt choose)
Private key  (I think its domain.key, so chosen it)

但如果尝试连接：

Certificate from VPN server [host ip] failed verification.
Reason: certificate does not match hostname
Do you want to accept it?

    Certificate from VPN server "194.176.96.4" failed verification.
    Reason: certificate does not match hostname
    Do you want to accept it?

With below info:
X.509 Certificate Information:
    Version: 3
    Serial Number (hex): ****
    Issuer: C=US,O=DigiCert Inc,OU=www.digicert.com,CN=GeoTrust RSA CA 2018
    Validity:
       Not Before: **
        Not After: **
    Subject: C=RU,ST=[city],L=[city],O=[company name],OU=IT,CN=vpn.[companyname].ru
    Subject Public Key Algorithm: RSA
    Algorithm Security Level: Medium (2048 bits)
....

我接受 - 和同样的错误证书验证失败，完整日志：

POST https://[host_name]/
Attempting to connect to server [host_name]:443
SSL negotiation with [host_name]
Server certificate verify failed: certificate does not match hostname
Connected to HTTPS on [host_name]
Got HTTP response: HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Cache-Control: no-cache
Pragma: no-cache
Connection: Keep-Alive
Date: Sun, 26 Aug 2018 08:43:32 GMT
X-Frame-Options: SAMEORIGIN
X-Aggregate-Auth: 1
HTTP body chunked (-2)
Server requested SSL client certificate; none was configured
POST https://[host_name]/
Got HTTP response: HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Cache-Control: no-cache
Pragma: no-cache
Connection: Keep-Alive
Date: Sun, 26 Aug 2018 08:43:32 GMT
X-Frame-Options: SAMEORIGIN
X-Aggregate-Auth: 1
HTTP body chunked (-2)
XML POST enabled

PS：在Windows上，同样的步骤有效，通过双击添加证书，然后启动思科客户端，键入服务器，然后他向我询问的服务器询问密码 - 然后我就连接了。

Answer 1

AnyConnect 支持 PEM 格式客户端证书进行身份验证。查看管理员指南，了解如何为 Linux 平台配置客户端证书。将客户端证书复制到该文件夹~/.cisco/certificates/client​​，将私钥复制到~/.cisco/certificates/client/private. 还 -

• 所有证书文件必须以扩展名 .pem 结尾。
• 所有私钥文件必须以扩展名 .key 结尾。
• 客户端证书及其相应的私钥必须具有相同的文件名。例如：client.pem 和 client.key。