Cisco Cisco AnyConnect Secure Mobility Client v4.x User Guide

AnyConnect uses the certificate received from the server to verify its identify. If there is a certificate error due to an expired or invalid
date, wrong key usage, or a name mismatch, the connection is blocked.

When this setting is ON, a blocking Untrusted VPN Server! notification alerts you to this security threat.

Procedure

Step 1

From the AnyConnect home window, tap Menu > Settings.

Step 2

Tap the Block Untrusted Servers checkbox to enable or disable this preference.

Set FIPS Mode

FIPS Mode makes use of Federal Information Processing Standards (FIPS) cryptography algorithms for all VPN connections.

Before You Begin

Your administrator will inform you if you need to enable FIPS mode on your mobile device for connectivity to your network.

Procedure

Step 1

From the AnyConnect home window, tap Menu > Settings.

Step 2

Tap FIPS Mode to enable or disable this preference.

Upon confirmation of your FIPS mode change, AnyConnect exits and must be restarted manually. Upon restart, your FIPS
mode setting is in effect.

Set OCSP Revocation

The Android AnyConnect client supports OCSP (Online Certificate Status Protocol). This allows the client to query the status of
individual certificates in real time by making a request to the OCSP responder and parsing the OCSP response to get the certificate
status. OCSP is used to verify the entire certificate chain. There is a five second timeout interval per certificate to access the OCSP
responder.

Before You Begin

Your administrator will inform you if you need to enable OCSP Revocation on your mobile device for connectivity to your network.

Procedure

Step 1

From the AnyConnect home window, tap Menu > Settings.

Step 2

Tap OCSP Revocation to enable or disable this preference.
Upon the next connectivity attempt, OCSP will be used, or not, to determine the revocation status of the certificate received
from the head-end.