<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>I want to make sure I am doing this correctly so I can rule it out as a problem. Please verify the syntax I use to generate my certificates will work with all client types:<br><br>About my setup: Strongswan v5.0.4 is running in server mode on my router (which also takes care of DHCP for my network) to roadwarriors (which also require access to my lan), using public key authentication.<br><br>-I will use a self-signed CA, which I will call CA-AUTH.<br>-My server's LAN IP is 192.168.1.1 and hostname is HOST.COM<br>-My clients are roadwarriors with a LAN IP addresses and hostnames that will constantly change.<br><br>To generate the certificate authority:<br><br>ipsec pki --gen --outform pem > caKey.pem<br><br>ipsec pki --self --in caKey.pem --dn "C=CA, O=none, CN=CA-AUTH" --san="CA-AUTH" --ca --outform pem > caCert.pem<br><br><br>To generate the server certificate and private key:<br><br>ipsec pki --gen --outform pem > serverKey.pem<br><br>ipsec pki --pub --in serverKey.pem | ipsec pki --issue --cacert caCert.pem --cakey caKey.pem --dn "C=CA, O=none, CN=192.168.1.1" --san="HOST.COM" --flag serverAuth --outform pem > serverCert.pem<br><br><br>To generate the client certificates and private keys:<br><br>ipsec pki --gen --outform pem > userKey.pem<br><br>ipsec pki --pub --in userKey.pem | ipsec pki --issue --cacert caCert.pem --cakey caKey.pem --dn "C=CA, O=none, CN=z10" --san "z10@HOST.COM" --flag serverAuth --outform pem > userCert.pem<br><br><br>I have established connections using the certificates I generated, though there is never any data going through the tunnels. I just want to be sure it isn't the certificates so I can move on... Thanks.<br> </div></body>
</html>