1

I managed to connect two AWS subnets in different zones over strongSwan VPN using ike2 with the aes256 encryption. So, Master CA key is created, self-signed CA certificate, as well as private and public keys for both gateways. After that, I created certificates for the roadwarrior and export them to win10 client in the p12 format.

The connection between those two LANs are working, but I am not able to attach the roadwarrior client.

I imported the certificates into win10 and the are normally visible in the certification manager.

Then I created VPN configuration using Windows10 VPN client, and when I run it I got from the Windows message:

A certificate could not be found that can be used with this Extensible Authentication Protocol.

Checking in certmagr everything is in the place.

The authentication method used is EAP-tls and it is working without a problem in LAN to LAN model.

Win10 VPN security property setup is:

Type of the VPN: IKE2 ,
Data Encryption: Require encryption (disconnect if server declines)
Authentication: Use Extensible Authentication Protocol 
-> Microsoft smart card or other certificates (encryption enabled)
    -> Properties
    ---> Use certificate on this computer
    ---> Verify the server's identity by validating the certificate
    ---> Trusted Root Certificate authority
    ----> Both certificates CA and the client p12 certificate are visible
          and checked

Here is ipsec.conf file

config setup
        charondebug="cfg 2, dmn 2, ike 2,net 2"
        uniqueids=yes
        strictcrlpolicy=no

conn %default
        fragmentation=force
        forceencaps=yes
        rekeymargin=3m
        mobike=no
        keyingtries=%forever
        ike=aes256-sha256-modp2048,aes256-sha2_256-modp1024!
        esp=aes256-sh256,aes256-sha2_256!
        ikelifetime=1h
        lifetime=8h
        dpddelay=30
        dpdtimeout=120
        dpdaction=restart
        authby=pubkey
        leftcert=vpn-west-public-certificate.pem
        leftsendcert=always
        keyexchange=ikev2
        type=tunnel
        leftca="C=DE, O=Orgname, CN=Orgname Root CA"
        leftid=13.57.xx.yy
        left=10.0.0.208
        leftsubnet=10.0.0.0/16

conn roadw
        right=%any
        rightid=%any
        rightauth=eap-tls
        rightsourceip=10.0.0.64/28
        rightsendcert=never
        rightdns=8.8.8.8
        eap_identity=%identity
        auto=add

Here is the IPsec.secrets file

13.57.xx.yy : RSA "/etc/ipsec.d/private/vpn-west-private-key.pem"
username : EAP "passphrase"

Any idea where to start, it looks that windows10 is not even starting the session, therefore it looks to me that something is wrong with the configuration of the VPN client at the Win10.

  • Bert thanks for editing, I have to learn to make it right. – klaus Aug 14 at 13:27
  • AFAIR the CA root as to be installed in the client/recognized by the client, however dealing with the problems of a Windows client is off-topic in a Linux group. – Rui F Ribeiro Aug 14 at 13:48
  • Dear Rui, CA root is installed in the client. I agree with you that Windows client issues do not really matter in a Linux group, but I suspect there are some tweaks at both sides, and I am not sure where to put that question since it is just connecting the client to the Linux device. I am very positive that a lot of Linux users could benefit from solving this issue. – klaus Aug 14 at 13:55
  • This is probably more on topic on superuser. I am also interested in the topic, used this technology in the past, and Windows can be very picky, both with the certificate and about using EAP-TLS-MSCHAPv2, which you are not using. – Rui F Ribeiro Aug 14 at 13:59
  • I found that the Windows requires the Hostname or IP Address to be listed in a san, like --san dns:13.57.xx.yy as a parameter during public server certificate, as well client (windows) user certificate need to have as CN=$USER" --san $USER. I added both parameters but no change. – klaus Aug 14 at 14:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.