A mid-sized company was migrating its VPN remote access from an old Cisco ASA 5510 to a newer ASA 5508-X. The security team decided to renew the SSL certificate for the AnyConnect VPN endpoint, moving from a 1024-bit RSA certificate to a more secure 2048-bit one. The certificate was issued by their internal Microsoft CA.
The ASA, when building the chain, used the older intermediate CA cert because it had a matching issuer name. It then checked the —but in the ASA’s validation logic, “EE key” in this context meant the public key of the end entity certificate presented by the client ? No, actually the error is misleading: it refers to the server certificate’s own key being too small ? Wait, not exactly. cisco asa certificate validation failed. ee key is too small
Upon investigation, the team found that the certificate chain installed on the ASA was incomplete. The ASA had the new server certificate (2048-bit) but still referenced an old, cached intermediate CA certificate that contained a 1024-bit public key. A mid-sized company was migrating its VPN remote
