Dear Maintainer,

   * What led up to the situation?
   Recent updates to our University's VPN, requiring upgrades to Cisco Secure Client 5.1.10.233 (Release Notes: https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/Cisco-Secure-Client-5/release/notes/release-notes-cisco-secure-client-5-1.html#secure-client-5-1-10-xxx-new-features), have made it impossible to connect with network-manager-openconnect any longer.  Before this, in order to login using SSO, the User-Agent had to be set to "AnyConnect" in order to get a WebView.  Then, a user and password could be used and, after that, 2FA.  Once the 2FA was successful, the VPN connection was established.  Now, after 2FA is successful, VPN connection fails with these messages in the system log:
   ```
   Connected to <VPN_IP>:443
   SSL negotiation with <VPN_HOST>
   Server certificate verify failed: signer not found
   Connected to HTTPS on <VPN_HOST> with ciphersuite (TLS1.3)-(ECDHE-SECP256R1)-(ECDSA-SECP384R1-SHA384)-(AES-128-GCM)
   Got inappropriate HTTP CONNECT response: HTTP/1.1 401 Unauthorized
   Creating SSL connection failed
   Cookie was rejected by server; exiting.
   ```

   * What exactly did you do (or not do) that was effective (or
     ineffective)?
   I've been troubleshooting over the past several days and nothing has been effective in getting a successful connection.  The Cisco Secure Client for Linux of course works.  Using a two-stage method on the command line with openconnect-sso and openconnect works.  For example:
   1) openconnect-sso -s https://<VPN_HOST> --ac-version "5.1.10.233" --authenticate shell
   This returns a COOKIE string upon success.

   2) sudo sh -c 'echo "<COOKIE>" | openconnect --protocol=anyconnect \
      --cookie-on-stdin --useragent="AnyConnect" VPN_HOST'
   This establishes the VPN connection.

   Thus, it seems it is network-manager-openconnect's inability to properly handle the cookie which causes the "certificate verify failed" and subsequent errors.

I've finally been able to get it working by using David Woodhouse's
packages built from the latest release, from his website: 

www.infradead.org

OpenConnect VPN client.
<https://www.infradead.org/openconnect/packages.html>

VPN client compatible with Cisco AnyConnect SSL VPN

🔗 https://www.infradead.org/openconnect/packages.html
<https://www.infradead.org/openconnect/packages.html>

then to his latest git HEAD repo: 

software.opensuse.org

Install package home:bluca:openconnect / openconnect
<https://software.opensuse.org/download.html?project=home%3Abluca%3Aopenconnect&package=openconnect>


🔗
https://software.opensuse.org/download.html?project=home%3Abluca%3Aopenconnect&package=openconnect
<https://software.opensuse.org/download.html?project=home%3Abluca%3Aopenconnect&package=openconnect>


Adding the repo and installing manually works the best.  It was
important to remove each of the packages: libopenconnect5, openconnect,
network-manager-openconnect, and network-manager-openconnect-gnome. 
Then, check `apt-cache policy <pkg_name>` and install all 4 packages
again, specifying the version for each, for example:

apt install openconnect=9.12+201+gf17fe20-0+284.110
libopenconnect5=9.12+201+gf17fe20-0+284.110
network-manager-openconnect=1.2.10+7+g030a3a9-0+101.463
network-manager-openconnect-gnome=1.2.10+7+g030a3a9-0+101.463

I thought I could get away with just installing
network-manager-openconnect-gnome=1.2.10+7+g030a3a9-0+101.463 but apt
complained about wrong version for network-manager-openconnect. 
However, when I specified the version for both, it happily grabbed
openconnect and libopenconnect5 from Debian repos instead of David's,
and the issue remained unresolved.  Be sure to carefully watch which
version's apt downloads and installs!  There's hopefully a nice way to
configure this in apt so the packages only upgrade from the repo they
were installed from, or something.  For now I'm happy to have a working
NM-plugin again and need to catch up on my work!

Hi,

Those packages build from HEAD of the openconnect upstream git,
include
https://gitlab.com/openconnect/openconnect/-/commit/94e0b16c011b7b88708b8a8505fac6bfbe2e3cca,
so the issue you are facing might be the same as:
https://bugs.debian.org/1099497

Regards,
Salvatore