cisco-sa-asa5500x-entropy-6v9bHVYP

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

Cisco has released software updates that address this vulnerability.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.