Configure Secure Client Certificate Auth on FTD Managed by FMC

Available Languages

Download Options

  • PDF     (2.2 MB)
    View with Adobe Reader on a variety of devices
  • ePub     (2.4 MB)
    View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
  • Mobi (Kindle)     (2.7 MB)
    View on Kindle device or Kindle app on multiple devices
Updated:August 14, 2026
Document ID:221839

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Introduction

This document describes configuring remote access VPN on FTD managed by FMC with certificate authentication.

Prerequisites

Requirements

Cisco recommends that you have knowledge of these topics:

  • FMC
  • Basic Authentication Knowledge for Remote Access VPN
  • Manual Certificate Enrollment and Basic Knowledge of Secure Sockets Layer (SSL)
  • Third-party Certificate Authority (CA) such as Entrust, Geotrust, GoDaddy, Thawte, and VeriSign

Components Used

The information in this document is based on these software versions:

  • FMC version 7.4.1
  • Secure Client Version 5.0.05040
  • Secure Firepower Threat Defense Version 7.4.1
  • Microsoft Windows Server 2019 as the CA Server

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Configure

Network Diagram

Network DiagramNetwork Diagram

Configurations

 Create/Import a Certificate Used for Server Authentication

note-icon

Note: On FMC, a Certificate Authority (CA) is required before you can generate the CSR. If the CSR is generated from an external source (OpenSSL or third-party party), the manual method fails and the PKCS12 certificate format must be used.

1. Navigate to Devices > Certificates and click Add. Choose Device and click the plus sign (+) under Cert Enrollment.

Add Cert EnrollmentAdd Cert Enrollment

2. Under CA Information, choose the Enrollment Type as Manual and paste the CA certificate used to sign the CSR.

Add CA InformationAdd CA Information

3. Choose Skip Check for CA flag in basic constraints of the CA Certificate as shown in the prior image.

4. Under Certificate Parameters, complete the subject name details.

Add Certificate ParametersAdd Certificate Parameters

5. Under Key, choose the key type as RSA with a key name and size. Click Save.

note-icon

Note: For the RSA key type, the minimum key size is 2048 bits.

Add RSA keyAdd RSA key

6. Under Cert Enrollment, choose the trust point from the drop-down menu, which was just created and click Add.

Add New CertificateAdd new Certificate

7. Click ID, then click Yes, to generate the CSR.

Generate CSRGenerate CSR

8. Copy the CSR and ensure it is signed by the CA. Once the Identity certificate is issued by the CA, import it by clicking Browse Identity Certificate and click Import.

Import ID CertificateImport ID Certificate

note-icon

Note: If the issuance of the ID certificate takes time, you can repeat Step 7. later. This generates the same CSR and you can import the ID certificate.

Add a Trusted/Internal CA Certificate

1. Navigate to Devices > Certificates and click Add.

2. Choose Device and click the plus sign (+) under Cert Enrollment.

3. In this example, auth-risaggar-ca is used to issue the identity/user certificates.

auth-risaggar-caauth-risaggar-ca

4. Enter a trustpoint name and choose Manual as the enrollment type under CA information.

5. Check CA Only and paste the trusted/internal CA certificate in pem format.

6. Check Skip Check for CA flag in basic constraints of the CA Certificate and click Save.

Add TrustpointAdd Trustpoint

7. Under Cert Enrollment, choose the trustpoint from the drop-down menu, which was just created and click Add.

Add Internal CAAdd Internal CA

8. The certificate added earlier is displayed as:

Added CertificateAdded Certificate

Configure Address Pool for VPN Users

1. Navigate to Objects > Object Management > Address Pools > IPv4 Pools.

2. Enter the name and IPv4 address range with a mask.

Add IPv4 PoolAdd IPv4 Pool

Upload Secure Client Images

1. Download web deploy secure client images per the OS from the Cisco Software site.

2. Navigate to Objects > Object Management > VPN > Secure Client File > Add Secure Client File.

3. Enter the name and choose the Secure Client file from the disk.

4. Choose the file type as Secure Client Image and click Save.

Add Secure Client ImageAdd Secure Client Image

Create and Upload XML Profile

1. Download and install the Secure Client Profile Editor from the Cisco Software site.

2. Create a new profile and choose All from the Client Certificate Selection drop down menu. This mainly controls which certificate are stored and which certificate Secure Client can use to based on what has been stored and to read certificates.

Two other available options are:

  • Machine: Secure Client is restricted to certificate lookup on the Windows local machine certificate store.
  • User: Secure Client is restricted to certificate lookup on the local Windows user certificate store.

Set Certificate Store Override as True.

This allows an administrator to direct Secure Client to utilize certificates in the Windows machine (Local System) certificate store for client certificate authentication. Certificate Store Override only applies to SSL, where the connection is initiated, by default in the UI process. When using IPSec/IKEv2, this feature in the Secure Client Profile is not applicable.

Add Preferences - Part 1Add Preferences (Part1)

3. (Optional) Uncheck the Disable Automatic Certificate Selection, as it avoids the prompt to choose the authentication certificate.

Add Preferences - Part 2Add Preferences (Part2)

4. Create a Server List Entry for setting up a profile in Secure Client VPN by providing group-alias and group-url under the Server List and save the XML profile.

Add Server ListAdd Server List

5. The XML profile is ready to use.

XML ProfileXML Profile

The location of XML profiles for various operating systems:

  • Linux - /opt/cisco/anyconnect/profile
  • MacOS - /opt/cisco/anyconnect/profile
  • Windows - C:\ProgramData\Cisco\Cisco Secure Client\VPN\Profile

6. Navigate to Objects > Object Management > VPN > Secure Client File > Add Secure Client Profile.

7. Enter the name for the file and click Browse to choose the XML profile. Click Save.

Add Secure Client VPN ProfileAdd Secure Client VPN Profile

Remote Access VPN Configuration

1. Create an ACL to allow access to internal resources.

2. Navigate to Objects > Object Management > Access List > Standard and click Add Standard Access List.

Add Standard ACLAdd Standard ACL

note-icon

Note: This ACL is used by Secure Client to add secure routes to internal resources.

3. Navigate to Devices > VPN > Remote Access and click Add.

4. Enter the name of the profile, then choose the FTD device and click Next.

Add Profile NameAdd Profile Name

5. Enter the Connection Profile Name and choose the Authentication Method as Client Certificate Only under Authentication, Authorization, and Accounting (AAA).

Select Authentication MethodSelect Authentication Method

6. Click Use IP Address Pools under Client Address Assignment, and choose the IPv4 Address Pool created earlier.

Select Client Address AssignmentSelect Client Address Assignment

7. Edit the Group Policy.

Edit Group PolicyEdit Group Policy

8. Navigate to General > Split Tunneling, choose Tunnel networks specified below and then Standard Access List under Split Tunnel Network List Type.

9. Choose the ACL created earlier.

Add Split TunnelingAdd Split Tunneling

10. Navigate to Secure Client > Profile, choose the Client Profile and click Save.

Add Secure Client ProfileAdd Secure Client Profile

11. Click Next, then select Secure Client Image and click Next.

Add Secure Client ImageAdd Secure Client Image

12. Choose the Network Interface for VPN Access, choose the Device Certificates and check sysopt permit-vpn and click Next.

Add Access Control for VPN TrafficAdd Access Control for VPN Traffic

13. Review all the configurations and click Finish.

Remote Access VPN Policy ConfigurationRemote Access VPN Policy Configuration

14. Once the initial setup of Remote Access VPN is complete, edit the Connection Profile created and navigate to Aliases.

15. Configure group-alias by clicking the plus icon (+).

Edit Group AliasEdit Group Alias

16. Configure the group-url by clicking the plus icon (+). Use the same Group URL configured earlier in the Client Profile.

Edit Group URLEdit Group URL

Step 17. Navigate to Access Interfaces. Choose the Interface Trustpoint and the SSL Global Identity Certificate  under the SSL settings.

Edit Access InterfacesEdit Access Interfaces

18. Click Save and deploy the changes.

Verify

Use this section to confirm your configuration works properly.

1. The secure client PC must have the certificate installed with a valid date, subject, and Enhanced Key Usage (EKU) on the PC of the user. This certificate must be issued by the CA whose certificate is installed on FTD as shown previously. In the next example, the identity or user certificate is issued by auth-risaggar-ca.

Certificate HighlightsCertificate Highlights

note-icon

Note: The client certificate must have the Client Authentication EKU.

2. Secure Client must establish the connection.

Successful Secure Client ConnectionSuccessful Secure Client Connection

3. Run the show vpn-sessiondb anyconnect command to confirm the connection details of the active user under the used tunnel group.

firepower# show vpn-sessiondb anyconnect

Session Type: AnyConnect

Username     : dolljain.cisco.com     Index        : 8
Assigned IP  : 10.20.20.1             Public IP    : 72.163.X.X
Protocol     : AnyConnect-Parent SSL-Tunnel
License      : AnyConnect Premium
Encryption   : AnyConnect-Parent: (1)none  SSL-Tunnel: (1)AES-GCM-128
Hashing      : AnyConnect-Parent: (1)none  SSL-Tunnel: (1)SHA256
Bytes Tx     : 14402                  Bytes Rx     : 9652
Group Policy : DfltGrpPolicy          Tunnel Group : RAVPN-CertAuth
Login Time   : 08:32:22 UTC Mon Mar 18 2024
Duration     : 0h:03m:59s
Inactivity   : 0h:00m:00s
VLAN Mapping : N/A                    VLAN         : none
Audt Sess ID : 0ac5de050000800065f7fc16
Security Grp : none                   Tunnel Zone  : 0

Troubleshoot

This section provides information to troubleshoot your configuration.

1. Debugs can be run from the diagnostic CLI of the FTD:

debug crypto ca 14
debug webvpn anyconnect 255
debug crypto ike-common 255

2. Refer to the Troubleshoot Cisco Secure Client VPN Common Problems guide for additional assistance.

Revision History

Revision Publish Date Comments
4.0
14-Aug-2026
Updated title, introduction, spelling, grammar, inserted horizontal lines to separate sections for readability.
3.0
26-Mar-2025
Updated the Image for ID Cert
2.0
24-Jun-2024
Updated configuration steps for clarity.
1.0
01-Apr-2024
Initial Release
TAC Authored

Contributed by Cisco Engineers

  • Dolly Jain
    Cisco TAC Engineer
  • Rishabh Aggarwal
    Cisco TAC Engineer

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products