I am setting up an IKEv2 VPN server using strongSwan on Ubuntu and experiencing issues with client authentication due to CA certificate errors.
This is the base: https://www.digitalocean.com/community/tutorials/how-to-set-up-an-ikev2-vpn-server-with-strongswan-on-ubuntu-20-04
My setup is as follows:
VPN Server: Ubuntu 24 LTS with strongSwan 6.6
Certificate Details:
Subject: CN = vpn.mydomain.com
Subject Alternative Name (SAN): DNS:vpn.mydomain.com, DNS:www. vpn.mydomain.com
The server's SSL certificate is correctly configured with its SAN covering both vpn.mydomain.com and www.vpn.mydomain.com. However, when client ( Android 14 Pixel 7A ) attempt to connect, the connection fails with the error:
failed to establish vpn verifying server authentication failed
User authentication : EAP
It seems like the issue is with the CA certificate not being recognized or not being available on the client devices, despite the server certificate appearing to be properly set up and linked to its issuer.
Client log on android strongSwan client show:
May 2 14:20:13 12[IKE] received end entity cert "CN=vpn.mydomain.com"
May 2 14:20:13 12[CFG] using certificate "CN=vpn.mydomain.com"
May 2 14:20:13 12[CFG] no issuer certificate found for "CN=vpn.mydomain.com"
May 2 14:20:13 12[CFG] issuer is "C=LV, L=Riga, O=GoGetSSL, CN=GoGetSSL RSA DV CA"
May 2 14:20:13 12[IKE] **no trusted RSA public key found for **'vpn.mydomain.com'
May 2 14:20:13 12[ENC] generating INFORMATIONAL request 2 [ N(AUTH_FAILED) ]
My server certificate:
I got this certificate on GoGetSSL website. My idea here not using self-signed certificates, so that I don't need to install root certificate on any device. GoGetSSL is USERTrust RSA certification Authority and it exist on my device. So my server certificate should be trust.
And yeah my domain is not vpn.mydomain.com, it is just example. I tried also Lets encrypt, result the same. But on my MacOs and iPhone all work perfectly fine.
ertificate:
Data:
Version: 3 (0x2)
Serial Number:
83:fc:58:44:59:f9:27:63:12:a2:23:57:5f:df:7a:54
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = LV, L = Riga, O = GoGetSSL, CN = GoGetSSL RSA DV CA
Validity
Not Before: May 2 00:00:00 2024 GMT
Not After : Jul 31 23:59:59 2024 GMT
Subject: CN = **vpn.mydomain.com**
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:97:d8:74:fb:66:a9:e8:95:61:91:8b:50:85:c5:
04:23:c0:09:0a:d6:ad:a5:0e:71:e5:76:69:c9:3a:
59:96:31:1f:7c:2f:ea:a1:27:14:6e:49:f2:f3:53:
af:e1:d3:1a:da:8c:d3:7e:53:ba:49:8f:50:bf:6f:
a7:1a:1b:1c:ce:c3:a7:9a:2d:71:cd:df:de:03:13:
23:53:04:6c:72:cb:69:8c:14:d9:63:40:5b:38:ca:
e9:b2:3a:bf:88:a6:39:fa:fe:03:85:2f:37:a8:7d:
c1:1c:ba:4d:69:ee:e1:bb:b1:49:71:d1:d7:4f:2c:
94:8a:91:39:6e:e7:41:b8:9d:f8:45:65:7c:93:c3:
45:4b:92:39:a5:25:d9:a4:8a:5f:33:37:85:c6:56:
83:a0:a9:c3:09:3d:5b:fd:2d:17:d3:94:25:2a:c2:
6e:71:aa:21:8c:25:91:be:ec:30:7f:b4:da:3d:43:
9c:1c:53:b9:55:45:dc:b9:97:e3:4c:c0:a6:9a:c9:
f0:42:67:14:dc:5d:c4:b8:3a:eb:8b:17:c5:92:f3:
1c:5d:7e:be:5e:e1:74:9f:f6:63:8c:06:b2:a6:08:
02:b3:d5:75:97:d9:63:01:e2:13:6d:5f:52:f9:0b:
9d:36:2e:ef:1b:59:3f:b5:bd:a6:f6:0c:5d:cc:fd:
f2:d3
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Authority Key Identifier:
F9:FB:50:C4:8B:67:BB:67:64:FE:83:21:A6:A9:CE:3F:55:84:93:99
X509v3 Subject Key Identifier:
C5:D5:1A:C2:81:B3:84:11:B3:90:4E:FC:1E:11:B1:5B:9C:DF:A1:61
X509v3 Key Usage: critical
Digital Signature, Key Encipherment
X509v3 Basic Constraints: critical
CA:FALSE
X509v3 Extended Key Usage:
TLS Web Server Authentication, TLS Web Client Authentication
X509v3 Certificate Policies:
Policy: 1.3.6.1.4.1.6449.1.2.2.64
CPS: https://cps.usertrust.com
Policy: 2.23.140.1.2.1
X509v3 CRL Distribution Points:
Full Name:
URI:http://crl.usertrust.com/GoGetSSLRSADVCA.crl
Authority Information Access:
CA Issuers - URI:http://crt.usertrust.com/GoGetSSLRSADVCA.crt
OCSP - URI:http://ocsp.usertrust.com
X509v3 Subject Alternative Name:
DNS:vpn.mydomain.com, DNS:www.vpn.mydomain.com
CT Precertificate SCTs:
Signed Certificate Timestamp:
Version : v1 (0x0)
Log ID : 76:FF:88:3F:0A:B6:FB:95:51:C2:61:CC:F5:87:BA:34:
B4:A4:CD:BB:29:DC:68:42:0A:9F:E6:67:4C:5A:3A:74
Timestamp : May 2 20:33:32.442 2024 GMT
Extensions: none
Signature : ecdsa-with-SHA256
30:45:02:21:00:97:26:B7:25:08:D3:C8:02:91:40:5D:
B8:80:7A:99:0D:E9:94:A7:10:C6:B9:AC:00:C0:F8:39:
E2:D3:74:50:A3:02:20:10:42:A4:0A:03:EF:A6:38:3D:
65:09:98:ED:72:0D:C0:AD:F8:EB:61:AD:4E:DB:A5:4C:
CE:30:7D:78:0D:15:85
Signed Certificate Timestamp:
Version : v1 (0x0)
Log ID : 3F:17:4B:4F:D7:22:47:58:94:1D:65:1C:84:BE:0D:12:
ED:90:37:7F:1F:85:6A:EB:C1:BF:28:85:EC:F8:64:6E
Timestamp : May 2 20:33:32.415 2024 GMT
Extensions: none
Signature : ecdsa-with-SHA256
30:46:02:21:00:A4:51:BD:EE:AF:51:4A:88:37:9A:2E:
BA:E4:08:36:49:2A:55:3E:39:C5:FB:1C:21:2D:9D:30:
5C:F5:BD:AE:58:02:21:00:BE:D3:A0:6A:06:4D:B9:0C:
9E:48:7D:8F:FF:93:3E:EB:4C:CF:F9:57:00:D2:84:41:
D1:43:BB:F2:F5:8A:3A:13
Signature Algorithm: sha256WithRSAEncryption
Signature Value:
14:36:32:d4:9b:b3:d4:ab:9e:ed:87:e5:5e:28:aa:e7:5d:15:
56:eb:ca:f7:b0:ca:09:d9:2b:af:35:92:38:0f:c6:f9:89:c7:
85:36:63:28:a4:c7:10:f9:02:23:76:0e:cb:78:80:08:1b:3c:
74:ec:b2:98:92:e9:a2:80:52:98:7d:95:36:ac:28:a3:01:62:
ba:08:f6:8d:d4:ac:18:51:7c:20:31:03:22:ff:76:69:10:65:
8e:ba:5f:4b:86:12:69:21:2a:78:41:f4:7b:cd:89:af:48:2c:
09:40:a7:8f:c6:5e:1e:ee:a9:26:2e:61:c6:65:3a:aa:67:de:
6c:15:93:d6:6d:09:0a:35:72:2c:81:88:aa:38:99:72:bb:1e:
5d:ae:1f:78:6a:7d:1a:3b:4d:03:8b:12:af:c2:4e:13:14:42:
0a:d5:6d:20:39:fd:1c:70:47:6f:39:19:35:a3:1a:35:d3:25:
d0:3f:81:9b:a7:e9:48:98:76:51:6f:f7:1b:90:20:0c:61:e8:
0c:bc:7d:d9:66:06:6a:5c:a3:1b:c6:ad:6d:20:02:f0:d6:1e:
9e:03:4c:40:71:81:ec:d3:db:57:33:ec:71:34:53:4d:6c:9e:
9f:61:bc:72:2f:59:4e:bd:27:0b:cd:2d:f2:5e:30:a1:8c:5b:
8f:3c:c0:99
Here is my config
config setup
charondebug="ike 1, knl 1, cfg 0"
uniqueids=no
conn ikev2-vpn
auto=add
compress=no
type=tunnel
keyexchange=ikev2
fragmentation=yes
forceencaps=yes
dpdaction=clear
dpddelay=300s
rekey=no
left=%any
[email protected]
leftcert=dinochain.pem
leftsendcert=always
leftsubnet=0.0.0.0/0
right=%any
rightid=%any
rightauth=eap-mschapv2
rightsourceip=10.10.10.0/24
rightdns=8.8.8.8,8.8.4.4
rightsendcert=never
eap_identity=%identity
ike=aes128-sha1-modp1024,aes128-sha1-modp1536,aes128-sha1-modp2048,aes128-sha256-ecp256,aes128-sha256-modp1024,aes128-sha256-modp1536,aes128-sha256-modp2048,aes256-aes128-sha25>
esp=aes128-aes256-sha1-sha256-modp2048-modp4096-modp1024,aes128-sha1,aes128-sha1-modp1024,aes128-sha1-modp1536,aes128-sha1-modp2048,aes128-sha256,aes128-sha256-ecp256,aes128-sh>
and secrets
: RSA dinopriv.pem
user : EAP "password"
Here are my questions:
How can I ensure that the CA certificate is properly installed or recognized on client devices?
Is there a specific configuration step I might be missing on the server side that could resolve this authentication issue?
Any help or suggestions would be greatly appreciated as I am currently unable to get the VPN connection established due to this server authentication error.
I tried Lets Encrypt and then tried GOGETSSL.
I can't find Lets Encrypt in my system certificates on android. But GOGETSSL exists. But it never helps.
Best Answer
This is the answer!
For either CA, you have to make sure the intermediate CA certificate that issued the server certificate is also sent. So install it in