# Cisco ASA Site-to-Site IPsec VPN Digital Certificates **URL:** \ **Category:** Lessons Discussion\ **Created:** [December 19, 2016, 4:40pm UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ipsec-vpn-digital-certificates/828 "2016-12-19T16:40:18Z")\ **Posts on this page:** 9\ **Page:** 2
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [June 29, 2021, 6:54am UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ipsec-vpn-digital-certificates/828/22 "2021-06-29T06:54:35Z")
Hello James Thanks for sharing your solution, it’s so helpful, and it’s what makes this forum such a great place for learning networking… Thanks again! Laz ---
**Author:** ![popetskaya](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/popetskaya/32/4497_2.png) [@popetskaya](https://forum.networklessons.com/u/popetskaya)\ **Post date:** [August 20, 2021, 6:52am UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ipsec-vpn-digital-certificates/828/23 "2021-08-20T06:52:20Z")
Hello, Will s-to-s work between ASAs with self-signed certificates? ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [August 22, 2021, 9:50am UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ipsec-vpn-digital-certificates/828/24 "2021-08-22T09:50:28Z")
Hello Anastasiys Cisco’s official advice on this issue is to never use self-signed certificates to authenticate. This kind of defeats the purpose of the security that the whole CA and certificates infrastructure delivers. It is possible to apply self-signed certificates on a site-to-site VPN configuration on Cisco IOS devices, however, I’m not so sure about ASAs. You can do it for [ANyconnect connections](https://networklessons.com/ciscoasa-firewall/cisco-asa-anyconnect-self-signed-certificate), but for site to site using ASAs, some users [seem to indicate that it cannot be done](https://community.cisco.com/t5/vpn/asa-site-to-site-with-self-signed-certificates/td-p/2281551). If you want to implement a site-to-site VPN without a CA, your best bet is to simply use [IKEv2 IPSEC](https://networklessons.com/ciscoasa-firewall/cisco-asa-site-site-ikev2-ipsec-vpn). I hope this has been helpful! Laz ---
**Author:** ![garyharris107](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/g/e56c9b/32.png) [@garyharris107](https://forum.networklessons.com/u/garyharris107)\ **Post date:** [October 14, 2022, 7:08pm UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ipsec-vpn-digital-certificates/828/25 "2022-10-14T19:08:31Z")
Hello, This configuration worked great when I was using software version 9.14 but when I upgraded to 9.16 everything stop. ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [October 19, 2022, 4:57am UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ipsec-vpn-digital-certificates/828/26 "2022-10-19T04:57:34Z")
Hello Gary According to [this Cisco command line reference for the ASA](https://www.cisco.com/c/en/us/td/docs/security/asa/asa-cli-reference/A-H/asa-command-ref-A-H/crypto-is-cz-commands.html#wp3837416760), it states the following: > For SSH, existing smaller keys can continue to be used after upgrading to 9.16, but we recommend that you upgrade to a larger size, or to a higher security key type. For other features, these RSA keys cannot be used in 9.16 and later. You can use the **crypto ca permit-weak-crypto** command to allow use of existing smaller keys, but even with this command, you cannot generate new smaller RSA keys. Due to the smaller size of keys used in versions prior to 9.16, your upgrade to 9.16 has rendered them unusable. You will have to recreate those keys in order to get it to work. Alternatively, you can use the `crypto ca permit-weak-crypto` command as suggested above, but it is not recommended. I hope this has been helpful! Laz ---
**Author:** ![kent2612](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/k/65b543/32.png) [@kent2612](https://forum.networklessons.com/u/kent2612)\ **Post date:** [March 14, 2024, 12:47pm UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ipsec-vpn-digital-certificates/828/27 "2024-03-14T12:47:34Z")
Hi Rene, Please help provide the steps on how to configure IPSec static virtual tunnel interface with Digital Certificates, where CSR needs to be generated and signed by a CA Server. ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [March 16, 2024, 6:28am UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ipsec-vpn-digital-certificates/828/28 "2024-03-16T06:28:56Z")
Hello Kenneth Take a look at this lesson which involves much of what you have asked for in your post: > **[Cisco ASA IPsec Site-to-Site IKEv1 Digital Certificates](https://networklessons.com/cisco/asa-firewall/cisco-asa-site-site-ipsec-vpn-digital-certificates)** > > This lesson explains how to configure your Cisco ASA Firewall IPsec IKEv1 site-to-site VPN with Digital certificates Authentication using OpenSSL. If there is something more specific that you would like to take a look at let us know so we can direct you appropriately. I hope this has been helpful! Laz ---
**Author:** ![kent2612](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/k/65b543/32.png) [@kent2612](https://forum.networklessons.com/u/kent2612)\ **Post date:** [March 18, 2024, 10:23am UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ipsec-vpn-digital-certificates/828/29 "2024-03-18T10:23:15Z")
Hi, any example for Cisco IOS instead? ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [March 20, 2024, 7:05am UTC](https://forum.networklessons.com/t/cisco-asa-site-to-site-ipsec-vpn-digital-certificates/828/30 "2024-03-20T07:05:52Z")
Hello Kenneth We don’t have a lesson for IPsec with digital certificates using a CA server and an IOS router, however, you may find something similar in some of the following links: > **[Dynamic LAN-to-LAN VPN between Cisco IOS Routers Using IOS CA on the Hub...](https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/81552-iosca.html)** > > This document provides a sample configuration for Dynamic LAN to LAN VPN between Cisco IOS(R) Routers that use digital certificates while utilizing the IOS Certificate Authority (CA) feature. This document demonstrates how to configure the IOS CA... > **[Routers - Retired Products](https://www.cisco.com/c/en/us/support/routers/retired.html)** > > Cisco Category page for retired Router products. > **[Security and VPN Configuration Guide, Cisco IOS XE 17.x - Configuring...](https://www.cisco.com/c/en/us/td/docs/routers/ios/config/17-x/sec-vpn/b-security-vpn/m_sec-key-exch-ipsec-0.html)** > > Configuring Internet Key Exchange for IPsec VPNs If you would like Rene to create a specific lesson with particular parameters, you can always go to the Member Ideas page below and share your suggestion there. You may find that others have made similar suggestions, and you can add your voice to theirs. > **[Lesson Ideas - NetworkLessons.com](https://networklessons.com/lesson-ideas)** > > This page allows networklessons members to share what content they would like to see in the future. I hope this has been helpful! Laz [Previous page](https://forum.networklessons.com/t/cisco-asa-site-to-site-ipsec-vpn-digital-certificates/828.md?page=1)