2

I just updated my MacBook Pro (Retina, 15-inch, Early 2013) to latest OS X Yosemite (10.10 (14A389)) and Cisco AnyConnect Secure Mobility Client (3.1.05182) is generating an error while trying to connect:

Posture Assessment Failed: CSD library signature verification failed.

Cisco AnyConnect Secure Mobility Client VPN User Messages, Release 3.1 - Cisco states following:

CSD library signature verification failed.
Description    The signature of the library could not be verified. This indicates a problem with the CSD library.

Recommended Action    Remove the library from the cache, and try a new connection.

Removing library from the cache did NOT solve my issue(

Any other ideas?

Improve this question

5 Answers 5

Reset to default
2

I had the same problem as the OP with Cisco AnyConnect version 2.3.2016: installing OS X 10.10 Yosemite broke it. Scrounging up a copy of 3.1.05187 WORKS (kind of) on my Mac.

I said "scrounge" because I couldn't download the correct version from Cisco's web site, because I don't have a login there associated with our license, and I couldn't get our local tech folks to understand why I couldn't just install the "MSI" file on my Mac.

Anyway, searching the web for "anyconnect-macosx-i386-3.1.05187-k9.dmg" unearthed a copy from a university web site (not something I like to do, particularly with security software), and behold, it installed and runs!

One wrinkle: unlike the older version, the newer one didn't route DNS lookups through the VPN. When Cisco establishes a VPN connection, it seems they edit "/etc/resolv.conf" to add the VPN's DNS servers. That doesn't work, and there's a warning to that effect in the Apple-generated "resolv.conf" file.

My work-around is to consult what Cisco added and manually add those servers through the Mac OS X Network Preference Pane.

Improve this answer
1
  • 1
    I really don't understand why Cisco has to make downloading their VPN client software so impossible. I go through this nonsense with the Hostscan failing to launch every time I upgrade OSX. Then I have to do something dirty like download a DMG file off a third party website (thanks for the tip, it worked and now I'm back on the VPN).
    – Nathan Beach
    Commented Feb 20, 2015 at 14:58
1

Here’s how to clean your caches:

  1. Open ~/Library/Caches in Finder.

  2. From the Menu bar, choose Edit > Select All.

  3. Drag all of the items to the Trash.

  4. From the Macintosh HD, choose Library > Caches.

  5. Choose Edit > Select All, and drag the items to the Trash. You'll be required to type in an administrator’s password.

  6. Restart your Mac.

Improve this answer
2
  • Cisco's recommended action did not solve my issue(
    – alexus
    Commented Oct 17, 2014 at 19:29
  • Show/Hide View Options ⌘J > Show Library Folder
    – alexus
    Commented Oct 20, 2014 at 2:58
1

According to Cisco's Release Notes for Cisco AnyConnect Secure Mobility Client, Release 3.1 - Cisco version 3.1.05187 should (re)solve this issue, unfortunately I'm still on previous release 3.1.05182. I'll post my finding as soon as I get to download new build (unless someone will beat me to it ;p).

We removed CSD from the configuration and used the latest version of HostScan instead:

no csd image disk0:/csd_3.5.841-k9.pkg
csd hostscan image disk0: /anyconnect-win-3.1.05187-k9.pkg
Improve this answer
2
  • Installed 3.1.05187, still unable to connect and still getting same error, already opened ticket with Cisco...
    – alexus
    Commented Oct 20, 2014 at 21:30
  • hostscan has to be on version 3.1, same as client in order for this to work! as soon as we updated our hostscan to 3.1+, i was able to vpn in without any issues)
    – alexus
    Commented Oct 29, 2014 at 14:43
-1

Are you licensed for the mobility client? Look at your Cisco ASA information and see if AnyConnect for Mobile is enabled or disabled.

Improve this answer
1
  • VPN was working fine prior to upgrading it to Yosemite (10.10).
    – alexus
    Commented Oct 23, 2014 at 21:12
-1

I think the unerlying issue is that Yosemite will not load kext (kernel extensions) unless they are signed by an authorized kernel extension developer. However in 10.8 and earlier, kexts could not be signed and signed kexts for 10.9+ will not load in <10.9.

Try this and after that reboot and try again.

sudo nvram boot-args="kext-dev-mode=1"

To revert do: sudo nvram -d boot-args

Improve this answer
1
  • That's not it, as I was able to get it going without messing with my nvram.
    – alexus
    Commented Oct 29, 2014 at 21:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .