AnyConnect client doesn't want to connect to Hostscan Bypass script about hostscan-bypass

[alexandru-2016]

I'm not sure if the untrusted server is the problem, perhaps cisco is now able to determine that there is a man in the middle attack happening.

[Gilks]

Untrusted connections are blocked by default. I've never used the AnyConnect client for linux. I assume there's a section in one of the config files that allow untrusted connections. Check out the blog post. Is there a graphical version for linux? If so, it may be the same steps as seen in the blog.

[NTMan]

You means uncheck option "Block connections to untrusted servers"?
Yes, I already tried to connect without this option, but same error message here.

Screenshots

I even tried to connect from AnyConnect mobile client but the client shows the same error message.

Screenshots

[alexandru-2016]

I have the same error. Allowing untrusted connections in the settings did not help.

[Gilks]

This is an AnyConnect client problem. This is not a hostscan-bypass issue.

If troubleshooting the certificate error has yielded no results then I would recommend using Let's Encrypt and putting a legitimate certificate on a domain you own. That will remove the need to connect to an untrusted host.

[Gilks]

I assure you it is because of an untrusted certificate. That's what this error is in reference to:

error: AnyConnect cannot confirm it is connected to your secure gateway. The local network may not be trustworthy. Please try another network.

[Gilks]

Any update on this issue?

[NTMan]

I assure you it is because of an untrusted certificate.

And, how to use trusted certificate?
Without hostscan bypass proxy script Android AnyConnect client connected without described error.

[Gilks]

It makes sense that you can connect directly to the ASA with Android because the certificate is being verified properly. Users on OS X were describing a similar issue. It has to do with the fact that your system is not respecting the AnyConnect option to connect to untrusted sources.

The cert/key arguments can be seen with the -h command.

Usage of /tmp/go-build751505018/b001/exe/hostscan-bypass:
  -c string
    	Use a config file (set TLS ect) - Commandline params overwrite config file
  -cert string
    	Use a specific certificate file
  -client-cert string
    	Read client certificate from file.
  -client-key string
    	Read client key from file. If only client-cert is given, the key and cert will be read from the same file.
  -l string
    	Local address to listen on
  -o string
    	Output name for CSD hostscan bypass
  -p int
    	Local Port to listen on
  -r string
    	Remote Server address host:port
  -s	Create a TLS Proxy
exit status 2

So to specify a cert/key:
sudo go run hostscan-bypass.go -l 0.0.0.0 -p 443 -r yourserver.com:443 -s -client-cert cert.pem -client-key key.pem