- CheckMates
- :
- Products
- :
- Quantum
- :
- Remote Access VPN
- :
- Re: Secure Domain Logon - Certificate is badly sig...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Secure Domain Logon - Certificate is badly signed
Hey Mates,
we are using Remote Access VPN with 3rd party CA (Windows PKI) on a 80.20 setup.
When clients try to use the secure logon to connect prior to Windows login, the users get a failed connection with the error message "Certificate is badly signed". As soon, as the windows login is over, the Remote Access login works just fine.
Also, we switched our CA a while ago. This problem only happens with Certificates from the new CA, with certificates from the old ca domain logon works
I dont really understand how to read the "Certificate is badly signed" message
What does this mean? How can it be badly signed and then it is accepted 2 minutes later? Is this a CRL problem?
I would appreciate some input, if anybody had such an issue before
Cheers
Accepted Solutions
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
The fix for the "Certificate is badly signed" issue will be available in coming E87.20 (should be GA within few weeks). If for some reason it doesn't help in your specific configuration, please open support case and refer this ID: "ESVPN-3747".
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did you import the CA key and all the intermediate certificates into the CA key store on the client?
When you imported the CA key into the gateway, did you also include any intermediate certificates?
At least from a few TAC cases, this seems to be one potential reason for the issue.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hey Phoneboy,
thank you for your reply
Yes, the CAs are correctly implemented on the clients and the gateway. Just for my own understanding, if it weren't correctly configured, the VPN shouldnt work at all?
I deactived the CRL checking on the gateway as described in sk21156 to see if it is a CRL problem, but it still doesn't work
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Would recommend opening a TAC here.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hey,
yeah, I am afraid I have to.
I tried a couple of things and I suspect it has to do with another issue I had a while ago with renewing a CA and posted here:
We'll see. Thanks for your help
Cheers
D
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We have the same issue but only for a few laptops with 86.60. We have opened a case howerver would like to know if there was a solution.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
The fix for the "Certificate is badly signed" issue will be available in coming E87.20 (should be GA within few weeks). If for some reason it doesn't help in your specific configuration, please open support case and refer this ID: "ESVPN-3747".
