Chapter 7
Configuring and Using AnyConnect Client Operating Modes and User Profiles
Certificate Matching Example
The following example shows how to enable the attributes that you can use to refine client certificate
selection.
OL-12950-012
<CertificateMatch>
<!--
Specifies Certificate Key attributes that can be used for choosing
acceptable client certificates.
-->
<KeyUsage>
<MatchKey>Non_Repudiation</MatchKey>
<MatchKey>Digital_Signature</MatchKey>
</KeyUsage>
<!--
Specifies Certificate Extended Key attributes that can be used for
choosing acceptable client certificates.
-->
<ExtendedKeyUsage>
<ExtendedMatchKey>ClientAuth</ExtendedMatchKey>
<ExtendedMatchKey>ServerAuth</ExtendedMatchKey>
<CustomExtendedMatchKey>1.3.6.1.5.5.7.3.11</CustomExtendedMatchKey>
</ExtendedKeyUsage>
<!--
Certificate Distinguished Name matching allows for exact
match criteria in the choosing of acceptable client
certificates.
-->
<DistinguishedName>
<DistinguishedNameDefinition Operator="Equal" Wildcard="Enabled">
<Name>CN</Name>
<Pattern>ASASecurity</Pattern>
</DistinguishedNameDefinition>
<DistinguishedNameDefinition Operator="Equal" Wildcard="Disabled">
<Name>L</Name>
<Pattern>Boulder</Pattern>
</DistinguishedNameDefinition>
</DistinguishedName>
</CertificateMatch>
Configuring Profile Attributes
Cisco AnyConnect VPN Client Administrator Guide
7-15