<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style>
</head>
<body class='hmmessage'>
Lars,<BR>
<BR>
IOS connects fine now. Thanks for the tip I installed root CA onto iphone and it connected. I was thinking the same thing CA will be installed by <BR>PKCS #12.<BR>
<BR>
I did the exact same thing on Snow Leopard but it still does not connect. I will keep trying and let you know. <BR>
<BR>
Did you try to connect osx with any success?<BR>
<BR>
Regards,<BR>
<BR>
Hafeez<BR>
<BR>
> Date: Fri, 10 Jun 2011 09:09:36 -0400<BR>> From: lars@hjersted.com<BR>> To: hafeezr@hotmail.com<BR>> CC: users@lists.strongswan.org<BR>> Subject: RE: [strongSwan] Apple cisco connect issue<BR>> <BR>> <BR>> > Lars,<BR>> > <BR>> > I went ahead and recreated the certificates based on your recommendations, altNames and flags are set correctly. Still same<BR>> > error.<BR>> > <BR>> > Then I upgraded to 4.5.1. It starts up fine on rc4 but exact same issue.<BR>> > <BR>> > Any other advice?<BR>> > <BR>> > Thanks for all the help.<BR>> > <BR>> > Hafeez<BR>> > <BR>> ><BR>> <BR>> Hafeez,<BR>> <BR>> I am running out of ideas, but I still suspect the issue is with the <BR>> client.<BR>> <BR>> I remember I had the same error on the Apple client when I was first <BR>> setting this up, but I do not recall if it was the same error in the <BR>> strongSwan logs. In my case I think it was because I did not have the root <BR>> CA installed on the iOS device since I originally assumed that it would <BR>> use a root CA included in a PKCS #12. I went ahead and deleted my root CA <BR>> from my iOS device and can confirm that I get the same errors as you on <BR>> both strongSwan and iOS. Although this still doesn't prove that it is <BR>> the same cause, I think it positively indicates that the issue is with the <BR>> client and not strongSwan.<BR>> <BR>> On your iphone under Settings > General > Profiles do you find both your <BR>> client certificate and root CA certificate? When you select each of these <BR>> profiles is it indicated that they are "trusted"? I also noticed that I <BR>> have the "clientAuth" EKU flag on my client certificate, but I doubt this <BR>> matters.<BR>> <BR>> You might also try using ports 500/4500.<BR>> <BR>> -Lars<BR> </body>
</html>