I'm trying to setup anyconnect from Cisco on a Fedora 19 machine. I have received some certificates from the organization running the VPN, but there are several layers between me and their IT people and it's very painful to try to get any support, so I'm hoping someone here will be able to help me out.

When I visit the website for the VPN I see a "Certificate Validation Failure" error, and similar when I try to use the vpnui client.

I had tried adding the 2 .cer certificates to /etc/pki/ca-trust/source/anchors then I ran update-ca-trust extract. When doing that I do see a message realted to one of the certificates:

p11-kit: duplicate 'AddTrust External CA Root' certificate found in: ca-bundle.trust.crt

And that shows up 5 times.

Visiting the website (using Chrome and Firefox) as well as using the vpnui client still produce the same "Certificate Validation Failure"

My googling is apparently very weak on this as I've not found anything to help me figure out what to try next. Any pointers would be very welcome.

Update: Though it seems happy now that I've imported the personal cert to my browser, here is what seems to me the error message from running openssl s_client -CAfile <path/to/ca.pem> -connect <server:port> with my personal cert or one of the two cer files as the CAfile and appropriate server:port:

Verify return code: 20 (unable to get local issuer certificate)

There was obviously a bunch more output, but without having a great internal handle on the security implications I'm loathe to share too many specific details about it.

The third cert they gave me seems to work fine though, I get a return code of 0 with that one.

I'm coming to believe that this question is perhaps misidentifying the original problem.

  • It might help to understand if there is more underpinning your validation failure; since the error is generic and can be caused by more than tracing the chain from CA -> leaf. Can you run 'openssl s_client -CAfile <path/to/ca.pem> -connect <server:port> against the VPN endpoint? You should get output from OpenSSL which might give a hint as to why validation is failing. May 4, 2015 at 14:24

1 Answer 1


Using Firefox to import my personal certificate let both Firefox and the vpnui client get through the certificate errors. For some reason, importing through Chrome did not allow the vpnui client to get through, though it could get to the login page itself.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .