<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div><span></span></div><div><div dir="ltr"><div style="font-size:13px">Hi,</div><div style="font-size:13px"><br></div><div style="font-size:13px">I have a problem with "no private key found" for ios 8 and eap-mschapv2. I am using strongswan 5.2.1 on ubuntu 14.04. </div><div style="font-size:13px"><br></div><div style="font-size:13px">I am not sure if eap-mschapv2 works with 5.2.1 but its probably something i am doing wrong. I looked for unit tests and cant find any for IOS with eap-mschapv2.</div><div style="font-size:13px"><br></div><div style="font-size:13px">I have a previous strongswan/freeradius setup on the same localhost and with mysql and it works fine with Ikev1 and ios. </div><div style="font-size:13px"><br></div><div style="font-size:13px">I have been reading these strongswan docs about Ikev2 and the supplied ios mobile config xml sample. </div><div style="font-size:13px"><br></div><div style="font-size:13px"><a href="https://wiki.strongswan.org/projects/strongswan/wiki/AppleIKEv2Profile#Authentication-options" target="_blank">https://wiki.strongswan.org/projects/strongswan/wiki/AppleIKEv2Profile#Authentication-options</a></div><div style="font-size:13px"><a href="https://wiki.strongswan.org/issues/708" target="_blank">https://wiki.strongswan.org/issues/708</a></div><div style="font-size:13px"><br></div><div style="font-size:13px">These more detailed docs i found google searching and are not on the main site index. </div><div style="font-size:13px"><br></div><div style="font-size:13px">I also read all the apple developer docs where i found you can also add an additional dict for the client key to go along with the ca cert but the thread talks about not needing it. I am not 100% sure that is now the case.</div><div style="font-size:13px"><br></div><div style="font-size:13px">From what I read in the support thread you can use Ikev2 and eap-mschapv2 together but not with a client key authentication. So it seems the extra embedded xml dict is not needed. </div><div style="font-size:13px"><br></div><div style="font-size:13px">I deployed my xml mobile config and base64 encoded the cacert correctly onto the ipad which installs fine.</div><div style="font-size:13px"><br></div><div style="font-size:13px">When the ios client negotiates I see great its matched to conn win7. I expected next use the eap-mschapv2 to authenticate but instead it says in the server logs:</div><div style="font-size:13px"><br></div><div style="font-size:13px">Dec 10 09:28:19 vpn2 charon: 12[IKE] received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding</div><div style="font-size:13px">Dec 10 09:28:19 vpn2 charon: 12[IKE] no private key found for '<a href="http://strongholdvpn2.ddns.net/" target="_blank">strongholdvpn2.ddns.net</a>'</div><div style="font-size:13px"><br></div><div style="font-size:13px">Full logs are given below. I am also not sure what the ESP_TFC_PADDING_NOT_SUPPORTED means.</div><div style="font-size:13px"><br></div><div style="font-size:13px">I have tried many combinations with/without this embedded client key dict and it makes no difference. <br></div><div style="font-size:13px"><br></div><div style="font-size:13px"><div>Also I have a slightly tweaked (maybe more correct ?) than the win7 sample ipsec.conf setup that works with the example mobile config eap-mschapv2 xml:</div><div><br></div><div>leftid=<a href="http://strongholdvpn2.ddns.net/" target="_blank">strongholdvpn2.ddns.net</a></div><div>rightid=*@<a href="http://strongholdvpn2.ddns.net/" target="_blank">strongholdvpn2.ddns.net</a></div><div>ike=aes128-sha1-modp2048!</div><div>esp=aes128-sha1!</div><div><br></div><div>The ike and esp now match to the recommeded xml settings in the sample config. left and rightid now seems to work together better this way.</div></div><div style="font-size:13px"><br></div><div style="font-size:13px">Please advise me what i am doing wrong as i have been at this for a while.</div><div style="font-size:13px"><br></div><div style="font-size:13px">#rightsendcert=never does not seem to make any difference. I added in leftsendcert=always from the advice given in the notes but makes no difference. </div><div style="font-size:13px"><br></div><div style="font-size:13px">Many Thanks</div><div style="font-size:13px">Carl</div><div style="font-size:13px"><br></div><div style="font-size:13px">Full setup below:</div><div style="font-size:13px"><br></div><div style="font-size:13px">root@vpn2:/etc/ipsec.d/certs# ipsec version</div><div style="font-size:13px">Linux strongSwan U5.2.1/K3.13.0-37-generic</div><div style="font-size:13px"><br></div><div style="font-size:13px">$Iptables -L</div><div style="font-size:13px">Chain INPUT (policy ACCEPT)</div><div style="font-size:13px">target prot opt source destination </div><div style="font-size:13px">ACCEPT udp -- anywhere anywhere udp dpt:isakmp</div><div style="font-size:13px">ACCEPT udp -- anywhere anywhere udp dpt:ipsec-nat-t</div><div style="font-size:13px">ACCEPT esp -- anywhere anywhere </div><div style="font-size:13px"><br></div><div style="font-size:13px">Chain FORWARD (policy ACCEPT)</div><div style="font-size:13px">target prot opt source destination </div><div style="font-size:13px"><br></div><div style="font-size:13px">Chain OUTPUT (policy ACCEPT)</div><div style="font-size:13px">target prot opt source destination </div><div style="font-size:13px"><br></div><div style="font-size:13px">$ipsec statusall</div><div style="font-size:13px"><br></div><div style="font-size:13px">Status of IKE charon daemon (strongSwan 5.2.1, Linux 3.13.0-37-generic, x86_64):</div><div style="font-size:13px"> uptime: 5 minutes, since Dec 10 09:38:29 2014</div><div style="font-size:13px"> malloc: sbrk 1486848, mmap 0, used 409872, free 1076976</div><div style="font-size:13px"> worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 0</div><div style="font-size:13px"> loaded plugins: charon aes rc2 sha1 sha2 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp xcbc hmac gcm attr kernel-netlink resolve socket-default farp stroke updown eap-identity eap-aka eap-md5 eap-gtc eap-mschapv2 eap-radius eap-tls eap-ttls eap-tnc xauth-generic xauth-eap tnc-tnccs dhcp lookip error-notify certexpire led addrblock unity</div><div style="font-size:13px">Virtual IP pools (size/online/offline):</div><div style="font-size:13px"> <a href="http://10.10.3.0/24" target="_blank">10.10.3.0/24</a>: 254/0/0</div><div style="font-size:13px">Listening IP addresses:</div><div style="font-size:13px"> 178.62.119.121</div><div style="font-size:13px"> 2a03:b0c0:1:d0::215:4001</div><div style="font-size:13px"> 10.131.213.244</div><div style="font-size:13px">Connections:</div><div style="font-size:13px"> win7: %any...%any IKEv2, dpddelay=300s</div><div style="font-size:13px"> win7: local: [<a href="http://strongholdvpn2.ddns.net/" target="_blank">strongholdvpn2.ddns.net</a>] uses public key authentication</div><div style="font-size:13px"> win7: cert: "C=CH, O=strongSwan, CN=<a href="http://strongholdvpn2.ddns.net/" target="_blank">strongholdvpn2.ddns.net</a>"</div><div style="font-size:13px"> win7: remote: [*@<a href="http://strongholdvpn2.ddns.net/" target="_blank">strongholdvpn2.ddns.net</a>] uses EAP_MSCHAPV2 authentication with EAP identity '%any'</div><div style="font-size:13px"> win7: child: <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> === dynamic TUNNEL, dpdaction=clear</div><div style="font-size:13px">Security Associations (0 up, 0 connecting):</div><div style="font-size:13px"> none</div><div style="font-size:13px"><br></div><div style="font-size:13px">My ipsec.config:</div><div style="font-size:13px"><br></div><div style="font-size:13px">conn %default</div><div style="font-size:13px"> keyexchange=ikev2</div><div style="font-size:13px"> ike=aes128-sha1-modp2048!</div><div style="font-size:13px"> esp=aes128-sha1!</div><div style="font-size:13px"> dpdaction=clear</div><div style="font-size:13px"> dpddelay=300s</div><div style="font-size:13px"> rekey=no</div><div style="font-size:13px"><br></div><div style="font-size:13px">conn win7 </div><div style="font-size:13px"> left=%any</div><div style="font-size:13px"> leftsubnet=<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a></div><div style="font-size:13px"> leftauth=pubkey</div><div style="font-size:13px"> leftcert=vpnHostCert.pem</div><div style="font-size:13px"> leftid=<a href="http://strongholdvpn2.ddns.net/" target="_blank">strongholdvpn2.ddns.net</a></div><div style="font-size:13px"> leftsendcert=always </div><div style="font-size:13px"> right=%any</div><div style="font-size:13px"> rightid=*@<a href="http://strongholdvpn2.ddns.net/" target="_blank">strongholdvpn2.ddns.net</a></div><div style="font-size:13px"> rightsourceip=<a href="http://10.10.3.0/24" target="_blank">10.10.3.0/24</a></div><div style="font-size:13px"> rightauth=eap-mschapv2</div><div style="font-size:13px"> eap_identity=%any</div><div style="font-size:13px"> #rightsendcert=never</div><div style="font-size:13px"> auto=add</div><div style="font-size:13px"><span style="white-space:pre-wrap"> </span></div><div style="font-size:13px"><span style="white-space:pre-wrap"> </span></div><div style="font-size:13px">Logs:</div><div style="font-size:13px"><br></div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 00[DMN] Starting IKE charon daemon (strongSwan 5.2.1, Linux 3.13.0-37-generic, x86_64)</div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 00[DMN] agent plugin requires CAP_DAC_OVERRIDE capability</div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 00[LIB] plugin 'agent': failed to load - agent_plugin_create returned NULL</div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 00[DMN] xauth-pam plugin requires CAP_AUDIT_WRITE capability</div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 00[LIB] plugin 'xauth-pam': failed to load - xauth_pam_plugin_create returned NULL</div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 00[CFG] HA config misses local/remote address</div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 00[LIB] plugin 'ha': failed to load - ha_plugin_create returned NULL</div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'</div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 00[CFG] loaded ca certificate "C=CH, O=strongSwan, CN=strongSwan Root CA" from '/etc/ipsec.d/cacerts/strongswanCert.pem'</div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'</div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'</div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'</div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 00[CFG] loading crls from '/etc/ipsec.d/crls'</div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 00[CFG] loading secrets from '/etc/ipsec.secrets'</div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 00[CFG] expanding file expression '/var/lib/strongswan/ipsec.secrets.inc' failed</div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 00[CFG] loaded 1 RADIUS server configuration</div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 00[LIB] loaded plugins: charon aes rc2 sha1 sha2 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp xcbc hmac gcm attr kernel-netlink resolve socket-default farp stroke updown eap-identity eap-aka eap-md5 eap-gtc eap-mschapv2 eap-radius eap-tls eap-ttls eap-tnc xauth-generic xauth-eap tnc-tnccs dhcp lookip error-notify certexpire led addrblock unity</div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 00[LIB] unable to load 5 plugin features (5 due to unmet dependencies)</div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 00[LIB] dropped capabilities, running as uid 0, gid 0</div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 00[JOB] spawning 16 worker threads</div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 08[NET] waiting for data on sockets</div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 05[CFG] received stroke: add connection 'win7'</div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 05[CFG] conn win7</div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 05[CFG] left=%any</div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 05[CFG] leftsubnet=<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a></div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 05[CFG] leftauth=pubkey</div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 05[CFG] leftid=<a href="http://strongholdvpn2.ddns.net/" target="_blank">strongholdvpn2.ddns.net</a></div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 05[CFG] leftcert=vpnHostCert.pem</div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 05[CFG] right=%any</div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 05[CFG] rightsourceip=<a href="http://10.10.3.0/24" target="_blank">10.10.3.0/24</a></div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 05[CFG] rightauth=eap-mschapv2</div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 05[CFG] rightid=*@<a href="http://strongholdvpn2.ddns.net/" target="_blank">strongholdvpn2.ddns.net</a></div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 05[CFG] eap_identity=%any</div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 05[CFG] ike=aes128-sha1-modp2048!</div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 05[CFG] esp=aes128-sha1!</div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 05[CFG] dpddelay=300</div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 05[CFG] dpdtimeout=150</div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 05[CFG] dpdaction=1</div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 05[CFG] mediation=no</div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 05[CFG] keyexchange=ikev2</div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 05[CFG] left nor right host is our side, assuming left=local</div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 05[CFG] adding virtual IP address pool <a href="http://10.10.3.0/24" target="_blank">10.10.3.0/24</a></div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 05[CFG] loaded certificate "C=CH, O=strongSwan, CN=<a href="http://strongholdvpn2.ddns.net/" target="_blank">strongholdvpn2.ddns.net</a>" from 'vpnHostCert.pem'</div><div style="font-size:13px">Dec 10 09:28:09 vpn2 charon: 05[CFG] added configuration 'win7'</div><div style="font-size:13px">Dec 10 09:28:18 vpn2 charon: 08[NET] received packet: from 195.102.55.203[500] to 178.62.119.121[500]</div><div style="font-size:13px">Dec 10 09:28:18 vpn2 charon: 08[NET] waiting for data on sockets</div><div style="font-size:13px">Dec 10 09:28:18 vpn2 charon: 11[NET] received packet: from 195.102.55.203[500] to 178.62.119.121[500] (416 bytes)</div><div style="font-size:13px">Dec 10 09:28:18 vpn2 charon: 11[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]</div><div style="font-size:13px">Dec 10 09:28:18 vpn2 charon: 11[CFG] looking for an ike config for 178.62.119.121...195.102.55.203</div><div style="font-size:13px">Dec 10 09:28:18 vpn2 charon: 11[CFG] candidate: %any...%any, prio 28</div><div style="font-size:13px">Dec 10 09:28:18 vpn2 charon: 11[CFG] found matching ike config: %any...%any with prio 28</div><div style="font-size:13px">Dec 10 09:28:18 vpn2 charon: 11[IKE] 195.102.55.203 is initiating an IKE_SA</div><div style="font-size:13px">Dec 10 09:28:18 vpn2 charon: 11[IKE] IKE_SA (unnamed)[1] state change: CREATED => CONNECTING</div><div style="font-size:13px">Dec 10 09:28:18 vpn2 charon: 11[CFG] selecting proposal:</div><div style="font-size:13px">Dec 10 09:28:18 vpn2 charon: 11[CFG] proposal matches</div><div style="font-size:13px">Dec 10 09:28:18 vpn2 charon: 11[CFG] received proposals: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048</div><div style="font-size:13px">Dec 10 09:28:18 vpn2 charon: 11[CFG] configured proposals: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048</div><div style="font-size:13px">Dec 10 09:28:18 vpn2 charon: 11[CFG] selected proposal: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048</div><div style="font-size:13px">Dec 10 09:28:18 vpn2 charon: 11[IKE] remote host is behind NAT</div><div style="font-size:13px">Dec 10 09:28:18 vpn2 charon: 11[IKE] sending cert request for "C=CH, O=strongSwan, CN=strongSwan Root CA"</div><div style="font-size:13px">Dec 10 09:28:18 vpn2 charon: 11[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(MULT_AUTH) ]</div><div style="font-size:13px">Dec 10 09:28:18 vpn2 charon: 11[NET] sending packet: from 178.62.119.121[500] to 195.102.55.203[500] (465 bytes)</div><div style="font-size:13px">Dec 10 09:28:18 vpn2 charon: 09[NET] sending packet: from 178.62.119.121[500] to 195.102.55.203[500]</div><div style="font-size:13px">Dec 10 09:28:19 vpn2 charon: 08[NET] received packet: from 195.102.55.203[4500] to 178.62.119.121[4500]</div><div style="font-size:13px">Dec 10 09:28:19 vpn2 charon: 08[NET] waiting for data on sockets</div><div style="font-size:13px">Dec 10 09:28:19 vpn2 charon: 12[NET] received packet: from 195.102.55.203[4500] to 178.62.119.121[4500] (364 bytes)</div><div style="font-size:13px">Dec 10 09:28:19 vpn2 charon: 12[ENC] parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr CPRQ(ADDR DHCP DNS MASK ADDR6 DHCP6 DNS6) N(ESP_TFC_PAD_N) N(NON_FIRST_FRAG) SA TSi TSr ]</div><div style="font-size:13px">Dec 10 09:28:19 vpn2 charon: 12[CFG] looking for peer configs matching 178.62.119.121[<a href="http://strongholdvpn2.ddns.net/" target="_blank">strongholdvpn2.ddns.net</a>]...195.102.55.203[<a href="mailto:client@strongholdvpn2.ddns.net" target="_blank">client@strongholdvpn2.ddns.net</a>]</div><div style="font-size:13px">Dec 10 09:28:19 vpn2 charon: 12[CFG] candidate "win7", match: 20/19/28 (me/other/ike)</div><div style="font-size:13px">Dec 10 09:28:19 vpn2 charon: 12[CFG] selected peer config 'win7'</div><div style="font-size:13px">Dec 10 09:28:19 vpn2 charon: 12[IKE] initiating EAP_IDENTITY method (id 0x00)</div><div style="font-size:13px">Dec 10 09:28:19 vpn2 charon: 12[IKE] processing INTERNAL_IP4_ADDRESS attribute</div><div style="font-size:13px">Dec 10 09:28:19 vpn2 charon: 12[IKE] processing INTERNAL_IP4_DHCP attribute</div><div style="font-size:13px">Dec 10 09:28:19 vpn2 charon: 12[IKE] processing INTERNAL_IP4_DNS attribute</div><div style="font-size:13px">Dec 10 09:28:19 vpn2 charon: 12[IKE] processing INTERNAL_IP4_NETMASK attribute</div><div style="font-size:13px">Dec 10 09:28:19 vpn2 charon: 12[IKE] processing INTERNAL_IP6_ADDRESS attribute</div><div style="font-size:13px">Dec 10 09:28:19 vpn2 charon: 12[IKE] processing INTERNAL_IP6_DHCP attribute</div><div style="font-size:13px">Dec 10 09:28:19 vpn2 charon: 12[IKE] processing INTERNAL_IP6_DNS attribute</div><div style="font-size:13px">Dec 10 09:28:19 vpn2 charon: 12[IKE] received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding</div><div style="font-size:13px">Dec 10 09:28:19 vpn2 charon: 12[IKE] no private key found for '<a href="http://strongholdvpn2.ddns.net/" target="_blank">strongholdvpn2.ddns.net</a>'</div><div style="font-size:13px">Dec 10 09:28:19 vpn2 charon: 12[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]</div><div style="font-size:13px">Dec 10 09:28:19 vpn2 charon: 12[NET] sending packet: from 178.62.119.121[4500] to 195.102.55.203[4500] (76 bytes)</div><div style="font-size:13px">Dec 10 09:28:19 vpn2 charon: 09[NET] sending packet: from 178.62.119.121[4500] to 195.102.55.203[4500]</div><div style="font-size:13px">Dec 10 09:28:19 vpn2 charon: 12[IKE] IKE_SA win7[1] state change: CONNECTING => DESTROYING</div><div style="font-size:13px"><br></div><div style="font-size:13px">Key setup:</div><div style="font-size:13px"><br></div><div style="font-size:13px">cd /etc/ipsec.d/</div><div style="font-size:13px">ipsec pki --gen --type rsa --size 4096 --outform pem > private/strongswanKey.pem</div><div style="font-size:13px">cat private/strongswanKey.pem</div><div style="font-size:13px">chmod 600 private/strongswanKey.pem</div><div style="font-size:13px">ipsec pki --self --ca --lifetime 3650 --in private/strongswanKey.pem --type rsa --dn "C=CH, O=strongSwan, CN=strongSwan Root CA" --outform pem > cacerts/strongswanCert.pem</div><div style="font-size:13px">cat cacerts/strongswanCert.pem</div><div style="font-size:13px">ipsec pki --print --in cacerts/strongswanCert.pem</div><div style="font-size:13px">ipsec pki --gen --type rsa --size 4096 --outform pem > private/vpnHostKey.pem</div><div style="font-size:13px">chmod 600 private/vpnHostKey.pem</div><div style="font-size:13px">ipsec pki --pub --in private/vpnHostKey.pem --type rsa | ipsec pki --issue --lifetime 730 --cacert cacerts/strongswanCert.pem --cakey private/strongswanKey.pem --dn "C=CH, O=strongSwan, CN=<a href="http://strongholdvpn2.ddns.net/" target="_blank">strongholdvpn2.ddns.net</a>" --san<a href="http://strongholdvpn2.ddns.net/" target="_blank">strongholdvpn2.ddns.net</a> --flag serverAuth --flag ikeIntermediate --outform pem > certs/vpnHostCert.pem</div><div style="font-size:13px">ipsec pki --print --in certs/vpnHostCert.pem</div><div style="font-size:13px">ipsec pki --gen --type rsa --size 4096 --outform pem > private/RsaKey.pem</div><div style="font-size:13px">chmod private/RsaKey.pem</div><div style="font-size:13px">chmod 600 private/RsaKey.pem</div><div style="font-size:13px">ipsec pki --pub --in private/RsaKey.pem --type rsa | ipsec pki --issue --lifetime 730 --cacert cacerts/strongswanCert.pem --cakey private/strongswanKey.pem --dn "C=CH, O=strongSwan, CN=<a href="mailto:client@yahoo.com" target="_blank">client@yahoo.com</a>" --san <a href="mailto:client@yahoo.com" target="_blank">client@yahoo.com</a> --outform pem > certs/RsaCert.pem</div><div style="font-size:13px">openssl pkcs12 -export -inkey private/RsaKey.pem -in certs/RsaCert.pem -name "Ecdsa VPN Certificate" -certfile cacerts/strongswanCert.pem -caname "StrongSwan Root CA" -out RsaUser.p12</div><div style="font-size:13px"><br></div><div style="font-size:13px">Strongswan.conf</div><div style="font-size:13px"><br></div><div style=""><div style="">charon {</div><div style=""> load_modular = yes</div><div style=""> plugins {</div><div style=""> include strongswan.d/charon/*.conf</div><div style=""> eap-radius {</div><div style=""> class_group = yes</div><div style=""> eap_start = yes</div><div style=""> servers {</div><div style=""> primary {</div><div style=""> address = localhost</div><div style=""> secret =sharedsec</div><div style=""> nas_identifer = ipsec-gateway</div><div style=""> sockets = 20</div><div style=""> }</div><div style=""> }</div><div style=""> }</div><div style=""> }</div><div style="">}</div><div style=""><br></div><div style="">include strongswan.d/*.conf</div></div><div style="font-size:13px"><br></div><div style="font-size:13px">Mobile config XML:</div><div style="font-size:13px"><br></div><div style="font-size:13px"><?xml version="1.0" encoding="UTF-8"?></div><div style="font-size:13px"><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "<a href="http://www.apple.com/DTDs/PropertyList-1.0.dtd" target="_blank">http://www.apple.com/DTDs/PropertyList-1.0.dtd</a>"></div><div style="font-size:13px"><plist version="1.0"></div><div style="font-size:13px"><dict></div><div style="font-size:13px"> <!-- Set the name to whatever you like, it is used in the profile list on the device --></div><div style="font-size:13px"> <key>PayloadDisplayName</key></div><div style="font-size:13px"> <string>Strong Hold VPN2</string></div><div style="font-size:13px"> <!-- This is a reverse-DNS style unique identifier used to detect duplicate profiles --></div><div style="font-size:13px"> <key>PayloadIdentifier</key></div><div style="font-size:13px"> <string>strongholdvpn2</string></div><div style="font-size:13px"> <!-- A globally unique identifier, use uuidgen on Linux/Mac OS X to generate it --></div><div style="font-size:13px"> <key>PayloadUUID</key></div><div style="font-size:13px"> <string>1f93912b-5fd2-4455-99fd-13b9a47b4582</string></div><div style="font-size:13px"> <key>PayloadType</key></div><div style="font-size:13px"> <string>Configuration</string></div><div style="font-size:13px"> <key>PayloadVersion</key></div><div style="font-size:13px"> <integer>1</integer></div><div style="font-size:13px"> <key>PayloadContent</key></div><div style="font-size:13px"> <array></div><div style="font-size:13px"> <!-- It is possible to add multiple VPN payloads with different identifiers/UUIDs and names --></div><div style="font-size:13px"> <dict></div><div style="font-size:13px"> <!-- This is an extension of the identifier given above --></div><div style="font-size:13px"> <key>PayloadIdentifier</key></div><div style="font-size:13px"> <string>StrongHoldVPN2</string></div><div style="font-size:13px"> <!-- A globally unique identifier for this payload --></div><div style="font-size:13px"> <key>PayloadUUID</key></div><div style="font-size:13px"> <string>82e4456d-3f03-4f15-b26f-4225d89465b7</string></div><div style="font-size:13px"> <key>PayloadType</key></div><div style="font-size:13px"> <string>com.apple.vpn.managed</string></div><div style="font-size:13px"> <key>PayloadVersion</key></div><div style="font-size:13px"> <integer>1</integer></div><div style="font-size:13px"> <!-- This is the name of the VPN conneciton as seen in the VPN application later --></div><div style="font-size:13px"> <key>UserDefinedName</key></div><div style="font-size:13px"> <string>StrongHold VPN2</string></div><div style="font-size:13px"> <key>VPNType</key></div><div style="font-size:13px"> <string>IKEv2</string></div><div style="font-size:13px"> <key>IKEv2</key></div><div style="font-size:13px"> <dict></div><div style="font-size:13px"> <!-- Hostname or IP address of the VPN server --></div><div style="font-size:13px"> <key>RemoteAddress</key></div><div style="font-size:13px"> <string><a href="http://strongholdvpn2.ddns.net/" target="_blank">strongholdvpn2.ddns.net</a></string></div><div style="font-size:13px"> <!-- Remote identity, can be a FQDN, a userFQDN, an IP or (theoretically) a certificate's subject DN. Can't be empty.</div><div style="font-size:13px"> IMPORTANT: DNs are currently not handled correctly, they are always sent as identities of type FQDN --></div><div style="font-size:13px"> <key>RemoteIdentifier</key></div><div style="font-size:13px"> <string><a href="http://strongholdvpn2.ddns.net/" target="_blank">strongholdvpn2.ddns.net</a></string></div><div style="font-size:13px"> <!-- Local IKE identity, same restrictions as above. If it is empty the client's IP address will be used --></div><div style="font-size:13px"> <key>LocalIdentifier</key></div><div style="font-size:13px"> <string><a href="mailto:client@strongholdvpn2.ddns.net" target="_blank">client@strongholdvpn2.ddns.net</a></string></div><div style="font-size:13px"> <!-- Optional, if it matches the CN of the root CA certificate (not the full subject DN) a certificate request will be sent</div><div style="font-size:13px"> NOTE: If this is not configured make sure to configure leftsendcert=always on the server, otherwise it won't send its certificate --></div><div style="font-size:13px"> <key>ServerCertificateIssuerCommonName</key></div><div style="font-size:13px"> <string>Example Root CA</string></div><div style="font-size:13px"> <!-- Optional, the CN or one of the subjectAltNames of the server certificate to verify it, if not set RemoteIdentifier will be used --></div><div style="font-size:13px"> <key>ServerCertificateCommonName</key></div><div style="font-size:13px"> <string>RsaCert.pem</string></div><div style="font-size:13px"> <!-- The server is authenticated using a certificate --></div><div style="font-size:13px"> <key>AuthenticationMethod</key></div><div style="font-size:13px"> <string>Certificate</string></div><div style="font-size:13px"> <!-- The client uses EAP to authenticate --></div><div style="font-size:13px"> <key>ExtendedAuthEnabled</key></div><div style="font-size:13px"> <integer>1</integer></div><div style="font-size:13px"> <!-- User name for EAP authentication, must be set as there is currently no prompt during installation.</div><div style="font-size:13px"> IMPORTANT: Because there is no prompt and this value cannot be changed later on the device a separate profile is required for every user --></div><div style="font-size:13px"> <key>AuthName</key></div><div style="font-size:13px"> <string>carl</string></div><div style="font-size:13px"> <!-- Optional password for EAP authentication, if it is not set the user is prompted when the profile is installed</div><div style="font-size:13px"> <key>AuthPassword</key></div><div style="font-size:13px"> <string>connect1</string></div><div style="font-size:13px"> --></div><div style="font-size:13px"> <!-- The next two dictionaries are optional (as are the keys in them), but it is recommended to specify them as the default is to use 3DES.</div><div style="font-size:13px"> IMPORTANT: Because only one proposal is sent (even if nothing is configured here) it must match the server configuration --></div><div style="font-size:13px"> <key>IKESecurityAssociationParameters</key></div><div style="font-size:13px"> <dict></div><div style="font-size:13px"> <key>EncryptionAlgorithm</key></div><div style="font-size:13px"> <string>AES-128</string></div><div style="font-size:13px"> <key>IntegrityAlgorithm</key></div><div style="font-size:13px"> <string>SHA1-96</string></div><div style="font-size:13px"> <key>DiffieHellmanGroup</key></div><div style="font-size:13px"> <integer>14</integer></div><div style="font-size:13px"> </dict></div><div style="font-size:13px"> <key>ChildSecurityAssociationParameters</key></div><div style="font-size:13px"> <dict></div><div style="font-size:13px"> <key>EncryptionAlgorithm</key></div><div style="font-size:13px"> <string>AES-128</string></div><div style="font-size:13px"> <key>IntegrityAlgorithm</key></div><div style="font-size:13px"> <string>SHA1-96</string></div><div style="font-size:13px"> <key>DiffieHellmanGroup</key></div><div style="font-size:13px"> <integer>14</integer></div><div style="font-size:13px"> </dict></div><div style="font-size:13px"> </dict></div><div style="font-size:13px"> </dict></div><div style="font-size:13px"><span style="white-space:pre-wrap"> </span><!-- This payload is optional but it provides an easy way to install the CA certificate together with the configuration --></div><div style="font-size:13px"> <dict></div><div style="font-size:13px"> <key>PayloadIdentifier</key></div><div style="font-size:13px"> <string>StrongHoldVPN2</string></div><div style="font-size:13px"> <key>PayloadUUID</key></div><div style="font-size:13px"> <string>18587b2c-33e0-4adf-a432-6fbcae543408</string></div><div style="font-size:13px"> <key>PayloadType</key></div><div style="font-size:13px"> <string>com.apple.security.root</string></div><div style="font-size:13px"> <key>PayloadVersion</key></div><div style="font-size:13px"> <integer>1</integer></div><div style="font-size:13px"> <!-- This is the Base64 (PEM) encoded CA certificate --></div><div style="font-size:13px"> <key>PayloadContent</key></div><div style="font-size:13px"> <data></div><div style="font-size:13px"> LS0tL (trunkated for this brevity)==</div><div style="font-size:13px"> </data></div><div style="font-size:13px"> </dict></div><div style="font-size:13px"> </array></div><div style="font-size:13px"></dict></div><div style="font-size:13px"></plist></div></div>
</div></body></html>