Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

When I try to connect using the Cisco AnyConnect VPN Client, I receive this error:

Connection attempt has failed due to server certificate problem.

Connection attempt has failed due to server certificate problem.

I happened to have this problem in my previous Ubuntu 11.10 installation. That time I could fix it using some tutorials on the internet (I don't remember which one). Basically, they suggested installing 4-5 packages and then some ln -s. But this time none of them are working. Can anyone help me step by step?

share|improve this question
add comment

7 Answers

up vote 6 down vote accepted

I can confirm that this problem exists. Anyconnect client worked fine with 11.10 but stops working with 12.04. Old trick with links to firefox libraries does not work anymore. I end up using OpenConnect.

Installation: http://www.humans-enabled.com/2011/06/how-to-connect-ubuntu-linux-to-cisco.html Routing: http://www.redips.net/linux/vpn-client-and-routing-2/

More details on Cisco Anyconnect problem:

As you can see from log: user was able to login, but Anyconnect client still failed to establish vpn connection.

Cisco AnyConnect VPN Client (version 2.5.3055) .

state: Connecting
notice: Establishing VPN session...
notice: Checking for profile updates...
notice: Checking for product updates...
notice: Checking for customization updates...
notice: Checking for localization updates...
state: Connecting
notice: Establishing VPN session...
notice: Establishing VPN - Initiating connection...
state: Disconnecting
notice: Disconnect in progress, please wait...
state: Disconnected
notice: VPN session ended.
error: The certificate on the secure gateway is invalid. A VPN connection will not be established.

error: AnyConnect was not able to establish a connection to the specified secure gateway. Please try connecting again.
notice: Connection attempt has failed.
state: Disconnected
share|improve this answer
1  
Thanks. It was super easy. apt-get install network-manager-openconnect-gnome –  Mohammad Moghimi May 6 '12 at 8:02
    
Tried getting AnyConnect to work with self-signed but I could not make it work. OpenConnect for NetorkManager worked right away though! –  Konstigt Jan 21 at 9:42
add comment

The following fix worked for me - fresh install of 12.04 LTS 32bit (with Firefox 12). Installed the AnyConnect client, then tried to run it.

Got this message:

AnyConnect cannot confirm it is connected to your secure gateway. The local network may not be trustworthy. Please try another network.

Checked syslog in Ubuntu. Lots of this sort of stuff:

CERTSTORE_ERROR_CERT_NOT_FOUND The /opt/.cisco/certificates/ca/ directory was not found

Created /.cisco/certificates/ca directories in /opt using sudo

cd /opt
sudo mkdir .cisco
cd .cisco/
sudo mkdir certificates
cd certificates/
sudo mkdir ca

We use Globalsign as our certificate authority. So I just copied all the Globalsign .pem files from /etc/ssl/certs. If you don't know your provider, you could just copy everything.

sudo cp /etc/ssl/certs/Global* /opt/.cisco/certificates/ca

or if CA is unknown

sudo cp /etc/ssl/certs/cd /etc/ssl/cert/* /opt/.cisco/certificates/ca

I was able to start the AnyConnect client and connect to the VPN

Hope this helps.

share|improve this answer
    
ln -s /etc/ssl/certs ~/.cisco/certificates/ca works as well –  veryhungry May 16 '12 at 5:16
    
Thanks, that worked for me. However, I think the command for copying everything should be sudo cp /etc/ssl/certs/Global* /opt/.cisco/certificates/ca –  user74011 Jun 29 '12 at 11:35
add comment

Copying the certificates did not work, but a combination of the two ended up working for me:

cd /etc/ssl/certs/cd
sudo ln -s /etc/ssl/certs/Global* .

Then ...

sudo apt-get install firefox 
cd /opt/cisco/vpn/lib
sudo ln -s /usr/lib/firefox/lib*.so .

... and bingo. I can log into work now :)

share|improve this answer
add comment

This is how I did it.

cd /opt
sudo mkdir .cisco
cd .cisco/
sudo mkdir certificates
cd certificates/
sudo mkdir ca

I then found out which certificate authority we use, which was COMODO, found a site that uses this CA, downloaded it with a browser and put it into the

/opt/.cisco/certificates/ca/ directory

voila!

share|improve this answer
add comment

I tried these solutions listed above and none of them helped. But when I tried some of these solutions below having to do with the firefox libraries, I had success!

Override certificate error in Cisco AnyConnect Client on Ubuntu 12.04 64 bit

Cisco AnyConnect in 64bit Ubuntu Linux

I can't say which is the BEST solution, but I followed the directions on both of these sites and had success. Perhaps you can find a solution that works for you. If you know which one is the best, please let us know which variable solved the problem immediately. All I know is that after making some of these changes, I finally got my Cisco Anyconnect VPN working. I am Firefox on Ubuntu 12.04.

share|improve this answer
add comment

Problem solved on Ubuntu 12.04 64 bits. see here: http://www.oit.uci.edu/security/vpn/vpn-lin.html

share|improve this answer
2  
@user180319 Welcome to Ask Ubuntu! Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. –  Eliah Kagan Aug 1 '13 at 4:43
add comment

Make sure that you have Firefox installed and are able to successfully launch it. If all is successful, there are a few other troubleshooting steps to try.

share|improve this answer
    
I do have firefox installed on my computer. –  Mohammad Moghimi May 1 '12 at 19:56
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.