Cisco Cisco NAC Appliance 4.1.0
Cisco NAC Appliance - Clean Access Manager Installation and Administration Guide
OL-12214-01
Chapter 15 Administration
Manage CAM SSL Certificates
On the CAM, View/Details/Delete buttons are disabled (greyed out) if the files are not installed (for
export) or not uploaded (for import). For example, if only a temporary certificate is present on the CAM,
the “Root/Intermediate CA” and “Currently Installed Root/Intermediate CA” View/Details/Delete
buttons will be disabled on the Import and Export forms, respectively.
export) or not uploaded (for import). For example, if only a temporary certificate is present on the CAM,
the “Root/Intermediate CA” and “Currently Installed Root/Intermediate CA” View/Details/Delete
buttons will be disabled on the Import and Export forms, respectively.
Troubleshooting Certificate Issues
Issues can arise during Cisco NAC Appliance certificate management, particularly if there are
mismatched SSL certificates somewhere along the certificate chain. Common problems on SSL
certificates can be time-oriented (if the clocks are not synchronized on the CAM and CAS,
authentication fails), IP-oriented (certificates are created for the wrong interface) or
information-oriented (wrong or mistyped certificate information is imported). This section describes the
following:
mismatched SSL certificates somewhere along the certificate chain. Common problems on SSL
certificates can be time-oriented (if the clocks are not synchronized on the CAM and CAS,
authentication fails), IP-oriented (certificates are created for the wrong interface) or
information-oriented (wrong or mistyped certificate information is imported). This section describes the
following:
•
•
•
•
No Web Login Redirect / CAS Cannot Establish Secure Connection to CAM
The following client connection errors can occur if the CAS does not trust the certificate of the CAM,
or vice-versa:
or vice-versa:
•
No redirect after web login— users continue to see the login page after entering user credentials.
•
Agent users attempting login get the following error: “Clean Access Server could not establish a
secure connection to the Clean Access Manager at <IPaddress or domain>” (
secure connection to the Clean Access Manager at <IPaddress or domain>” (
)
These errors typically indicate one of the following certificate-related issues:
•
The time difference between the CAM and CAS is greater than 5 minutes.
•
Invalid IP address
•
Invalid domain name
•
CAM is unreachable
To identify common issues:
1.
Check the CAM’s certificate and verify it has not been generated with the IP address of the CAS.
2.
Check the time set on the CAM and CAS. The time set on the CAM and the CAS must be 5 minutes
apart or less.
apart or less.
To resolve these issues:
1.
Set the time on the CAM and CAS correctly first (see
)
2.
Regenerate the certificate on the CAS using the correct IP address or domain.
3.
Reboot the CAS.
4.
Regenerate the certificate on the CAM using the correct IP address or domain.
5.
Reboot the CAM.