Here’s a concise incident-style story based on that error message. The Case of the Too-Small Key
Upon investigation, the team found that the certificate chain installed on the ASA was incomplete. The ASA had the new server certificate (2048-bit) but still referenced an old, cached intermediate CA certificate that contained a 1024-bit public key. cisco asa certificate validation failed. ee key is too small
Let me clarify: On a Cisco ASA, when acting as an SSL/TLS server (e.g., for VPN), it validates client certificates if client cert auth is enabled. The error “EE key is too small” means a client presented a certificate whose public key size was below the ASA’s configured minimum (default often 1024 or 2048 depending on version/configuration). But in their case, no client cert auth was enabled. Here’s a concise incident-style story based on that
They disabled client certificate authentication on the VPN tunnel group (since they used AAA username/password + MFA), and the error stopped. Users with old client certs could connect again, because the ASA no longer tried to validate those certs. For long-term security, they also forced re-enrollment of client certs to 2048-bit minimum. Let me clarify: On a Cisco ASA, when