LDAPS Certificate Requirement for FTD Remote Access VPN
Short answer
D The LDAPS server certificate must be added to Secure Firewall Threat Defense to establish trust for the SSL connection.
Question
A VPN administrator converted an instance of Cisco Secure Firewall Threat Defense, which is managed by Cisco Secure Firewall Management Center, from using LDAP to LDAPS for remote access VPN authentication. Which certificate must be added to allow for remote users to authenticate over the VPN?
Key Takeaways
The FTD device directly handles remote access VPN authentication, meaning it must establish the SSL connection to the LDAPS server and therefore trust its certificate.
When converting from LDAP to LDAPS for remote access VPN authentication on a Cisco Secure Firewall Threat Defense (FTD), the FTD must trust the LDAPS server. This page establishes that the LDAPS server certificate must be added to the FTD, not the FMC.
Common mistake: Choosing B because LDAPS realms are configured in FMC, but FMC does not perform the RA VPN authentication; the FTD does, so FTD requires the certificate trust.
Expert Analysis
Why the Answer Is Correct
For remote access VPN authentication, the Cisco Secure Firewall Threat Defense (FTD) device acts as the AAA client and directly initiates the connection to the LDAPS server. To establish a secure SSL/TLS tunnel for LDAPS, the FTD must authenticate the LDAPS server, which requires the FTD to possess the LDAPS server's root CA certificate in its trust store. Therefore, the LDAPS server certificate must be added to the FTD (typically configured via FMC's Objects > PKI > Trusted CAs and deployed to the FTD).Why the Other Options Are Wrong
Option B is incorrect because while the FMC is used to configure the identity realm and PKI objects, the FMC itself does not perform the RA VPN authentication or initiate the LDAPS connection; the FTD does. Option A is incorrect because the LDAPS server does not need to trust the FTD's certificate for the FTD to authenticate to it over LDAPS. Option C is incorrect because the FMC is not the device establishing the LDAPS connection for VPN authentication.Community Comment Notes
Some learners incorrectly assume FMC handles the authentication because realms are configured there, as noted by jcjcjcjcjc who stated "If you use FMC you add it on the FMC". However, as whysohardwhy correctly pointed out, "FTD does the authN, not FMC". The certificate is configured in FMC but deployed to FTD, with artilling providing the exact path "under Objects > PKI > Trusted CAs > Add Trusted CA" to satisfy the FTD's trust requirement.Official Reference
Exam Strategy
Remember that FMC is only a management plane; the FTD is the data plane device that actually processes VPN connections and authentication. Therefore, trust relationships (like LDAPS certificates) must be established on the FTD.
Community Votes
67% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 4 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded.
From public community threads 4
-
Pata311 👍 3 Answered BThe certificate must be added to FMC realm
-
artilling 👍 1 Answered DCorrect Answer: D import the Root CA Certificate that has signed the LDAPS service Certificate on the Windows Server under Objects > PKI > Trusted CAs > Add Trusted CA, as this is referenced under theDirectory Server Configuration of the Realm https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client-v4x/220880-configure-password-management-using-ldap.html#toc-hId--2065014694
-
jcjcjcjcjc 👍 1 Answered BIf you use FMC you add it on the FMC
-
whysohardwhy 👍 1 Answered DFTD does the authN, not FMC
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.