Setting up Cisco Any Connect with custom certificate

[Announcer]

I have tested the MX AnyConnect and it works fine.  I wanted to have it so the certificate is trusted.  

I choose "custom" in "secure connection between MX and Cisco  Secure clients" and click on "generate csr"

For the Common Name, I'm struggling.

Do I put the dynamic host name: xxx-xxxxx.dynamic-m.com?  If I go this route, and enter the csr in an SSL website, it asks to be authenticated via email going to admin@xxx-xxxxx.dynamic-m.com---which of course I don't have access to.  How can this be resolved?

[Mloraditch]

The custom cert option is if you want to use remote.yourdomain.com or similar. Meraki will auto provision a trusted cert for the dynamic dns url and no additional work is needed if you are ok providing that url to your users.

[rhbirkelund]

To add to @Mloraditch if you want to use your own domain for AnyConnect, if you have a HA pair of MX'es you'll need to provide a certificate for both the active and standby MX.

You cannot use the same certificate for both.

[Announcer]

Thanks.  I do plan on using warm spare.

[PhilipDAth]

The certificate used by Meraki for the AnyConnect head end is already a publicly trusted certificate.  Just connect to the DDNS name.

[Announcer]

What do you mean by connect to the ddns name mean?  When I use the general one, I get the notification that the certificate is not trusted.

[Mloraditch]

He's talking about this setting, whatever that URL is should work without certificate issues. If it's not it's probably your endpoints trusted roots not up to date, but you can check with support to verify the cert is provisioned

https://documentation.meraki.com/MX/Other_Topics/Dynamic_DNS_(DDNS)