{"id":7434,"date":"2020-08-11T02:39:36","date_gmt":"2020-08-11T02:39:36","guid":{"rendered":"https:\/\/rax-stg-wp-aws.com\/blogs\/use-an-anyconnect-certificate-and-otp-based-authentication\/"},"modified":"2026-11-03T19:28:40","modified_gmt":"2026-11-03T19:28:40","slug":"use-an-anyconnect-certificate-and-otp-based-authentication","status":"publish","type":"blogs","link":"https:\/\/www.rackspace.com\/en-gb\/blogs\/use-an-anyconnect-certificate-and-otp-based-authentication\/","title":{"rendered":"Use an AnyConnect certificate and OTP-based authentication"},"content":{"rendered":"<p><strong>Introduction<\/strong><\/p>\n<p>Certificate-based authentication is one of the most secure methods that Cisco&nbsp;AnyConnect provides to enable you to access VPN remotely with a one-time password (OTP).<\/p>\n<p>After software version 8, Cisco\u00ae&nbsp; included a complete certificate authority&nbsp;(CA) solution in the firewall with a web front end. This post describes how to&nbsp;use the built-in CA server feature of Adaptive Security Appliance (ASA) to issue&nbsp;certificates to SSL clients and perform certificate-based authentication.<\/p>\n<p><strong>Overview<\/strong><\/p>\n<p>\nUse the following steps to implement certificate and OTP-based authentication&nbsp;for an existing AnyConnect\u00ae environment:<\/p>\n<ul>\n<li>Check and synch the time<\/li>\n<li>Activate and configure local CA server<\/li>\n<li>Create user accounts for all users eligible to obtain an identity certificate from ASA<\/li>\n<li>Create a tunnel group that uses certificate-based authentication<\/li>\n<li>Change the VPN authentication to the certificate<\/li>\n<li>Create a map certificate to the connection profile<\/li>\n<\/ul>\n<p><strong>Set up certificate-based authentication<\/strong><\/p>\n<p>Perform the following steps to verify certificate-based authentication forAnyConnect remote access VPN:<\/p>\n<p>&nbsp;1. Verify the correct date and time<\/p>\n<p>Use the following commands to verify the current time:<\/p>\n<p>&nbsp;<em> &nbsp; show clock<br \/>\n&nbsp; &nbsp; show ntp status<\/em><\/p>\n<p>If time is not synced correctly, you need to match it with the external NTP server.<\/p>\n<p><strong>Activate and configure the local CA server<\/strong><\/p>\n<p>Issue the following commands to activate the local CA server, configure the&nbsp;lifetime, key size, certificate issuer, and create a strong passphrase to protect&nbsp;the local CA server. You can also configure the SMTP server used to send&nbsp;instructions to users for obtaining identity certificates.<\/p>\n<p><em>&nbsp; &nbsp; crypto ca server<br \/>\n&nbsp; &nbsp; lifetime ca-certificate 3650<br \/>\n&nbsp; &nbsp; lifetime certificate 365<br \/>\n&nbsp; &nbsp; keysize 2048<br \/>\n&nbsp; &nbsp; keysize server 2048<br \/>\n&nbsp; &nbsp; issuer-name CN=anyconnect certificate authentication<br \/>\n&nbsp; &nbsp; no shutdown passphrase Cisco987<\/em><\/p>\n<p><strong>3. Create user accounts and a one-time password<\/strong><\/p>\n<p>After you enable CA, use the following commands to create user accounts for all&nbsp;the users eligible to obtain an ASA identity certificate.<\/p>\n<p><em>&nbsp; &nbsp; crypto ca server user-db add cert_user dn CN=cert_user ,OU=IT,O=exampleorganization<br \/>\n&nbsp; &nbsp; crypto ca server user-db allow user cert_user display-otp<\/em><\/p>\n<p>Take note of the OTP and keep it handy.<\/p>\n<p>To download and import the certificate, browse to<br \/>\n**https:\/\/\\&lt;firewall IP address\\&gt;\/+CSCOCA\/+enroll log** and log in with your<br \/>\nusername and OTP as shown in the following image.<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26418-body-Picture1_29.png\" alt=\"cisco pic 1\" \/><\/p>\n<p><strong>&nbsp;4. Create a tunnel group&nbsp;<\/strong><\/p>\n<p>Run the following commands to create a tunnel group where you are going to use&nbsp;the certificate-based authentication:<\/p>\n<p><em>&nbsp; &nbsp; tunnel-group AnyConnect-TG-Cert type remote-access<br \/>\n&nbsp; &nbsp; tunnel-group AnyConnect-TG-Cert general-attributes<br \/>\n&nbsp; &nbsp; address-pool AnyConnect-Pool<br \/>\n&nbsp; &nbsp; default-group-policy AnyConnect-GP<\/em><\/p>\n<p><strong>5. Change the VPN authentication<\/strong><br \/>\nRun the following commands to change the VPN authentication to the certificate:&nbsp;<\/p>\n<p><em>&nbsp; &nbsp; tunnel-group AnyConnect-TG-Cert webvpn-attributes<br \/>\n&nbsp; &nbsp; authentication certificate<\/em><\/p>\n<p><strong>6. Create a map certificate<\/strong><\/p>\n<p>Run the following commands to create a certificate map to the tunnel group so&nbsp;ASA uses the right user connection profiles for users authenticating with&nbsp;identity certificates:<br \/>\n&nbsp;<\/p>\n<p><em>&nbsp;crypto ca certificate map Cert-MAP 100<br \/>\n&nbsp; &nbsp; subject-name attr ou eq IT<br \/>\n&nbsp; &nbsp; webvpn<br \/>\n&nbsp; &nbsp; certificate-group-map Cert-MAP 100 AnyConnect-TG-Cert<\/em><\/p>\n<p><strong>7. Connect to the VPN portal<\/strong><\/p>\n<p>After you complete the preceding steps, the system will prompt users for&nbsp;certificate-based authentication when they connect to the VPN portal, as shown&nbsp;in the following image:<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26418-body-Picture2_24.png\" alt=\"cisco pic 2\" \/><\/p>\n<p>&nbsp;<\/p>\n<p><strong>Conclusion&nbsp;<\/strong><\/p>\n<p>By using the steps in this post, you can easily configure certificate-based&nbsp;authentication for Cisco AnyConnect Remote access VPN and set up the authentication&nbsp;process with the built-in CA server. You can also use a third-party, paid CA server in production to meet the regulatory compliance and standard requirements.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Use an AnyConnect certificate and OTP-based authentication<\/p>\n","protected":false},"author":2,"featured_media":7436,"menu_order":0,"comment_status":"open","ping_status":"open","template":"","format":"standard","meta":{"content-type":"","nid":"26418","content_type":"blog","created_by":"10130","authored_on":"2023-12-29T03:39:36+00:00","field_article_industries":"","tag_category":"Technical","field_blog_author_text":"by Mayukh Mandal, Network Security Engineer, Rasckspace Technology","seo_description":"Learn how to enable remote VPN access using an AnyConnect certificate and OTP-based authentication system.\r\n","field_featured_image":"","insights_image":"\/wp-content\/uploads\/2026\/blog_technical_images\/26418-insights_image-general-processes-technical-blog-2-insights.jpg","field_partners":"","rxt_platforms":"Cisco","product":"","publisheddate":"2020-08-11T02:39:36","rxt_solutions":"Security","opengraph_tag":"","x_tag":"","teaser_flag":"Technical Blog","seo_titile":"AnyConnect Certificate with OTP-based Authentication | Rackspace","field_topics":"","field_slug":"use-an-anyconnect-certificate-and-otp-based-authentication","footnotes":""},"categories":[178],"tags":[204],"class_list":["post-7434","blogs","type-blogs","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-technical"],"_links":{"self":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/7434","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs"}],"about":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/types\/blogs"}],"author":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/comments?post=7434"}],"version-history":[{"count":3,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/7434\/revisions"}],"predecessor-version":[{"id":9455,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/7434\/revisions\/9455"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/media\/7436"}],"wp:attachment":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/media?parent=7434"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/categories?post=7434"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/tags?post=7434"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}