<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<style>
<!--
@font-face
{font-family:"Cambria Math"}
@font-face
{font-family:Calibri}
p.x_MsoNormal, li.x_MsoNormal, div.x_MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif}
a:link, span.x_MsoHyperlink
{color:blue;
text-decoration:underline}
a:visited, span.x_MsoHyperlinkFollowed
{color:#954F72;
text-decoration:underline}
.x_MsoChpDefault
{}
@page WordSection1
{margin:1.0in 1.0in 1.0in 1.0in}
div.x_WordSection1
{}
-->
</style>
<div lang="EN-US" link="blue" vlink="#954F72">
<div class="x_WordSection1">
<p class="x_MsoNormal">IIRC from when I looked at this, I was able to have two completely different servers configured on my Win10 client, and it worked correctly. I think the trick is to make sure that each VPN server has a different hostname (duh), and that
the VPN SAN keys in the certs contain the FQDN hostname.</p>
<p class="x_MsoNormal"> </p>
<div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0in 0in 0in">
<p class="x_MsoNormal" style="border:none; padding:0in"><b>From: </b><a href="mailto:tobias@strongswan.org">Tobias Brunner</a><br>
<b>Sent: </b>Monday, February 25, 2019 3:30 AM<br>
<b>To: </b><a href="mailto:trymes@rymes.com">Tom Rymes</a>; <a href="mailto:users@lists.strongswan.org">
users@lists.strongswan.org</a><br>
<b>Subject: </b>Re: [strongSwan] Windows Client - Multiple Connections, Multiple Certs</p>
</div>
<p class="x_MsoNormal"> </p>
</div>
</div>
<font size="2"><span style="font-size:11pt;">
<div class="PlainText">Hi Tom,<br>
<br>
> I do not see anywhere that I <br>
> can specify which certificate the client should use for a given connection.<br>
<br>
I think you can only do that with EAP-TLS (i.e. not with machine<br>
certificates) where you might actually get prompted for a certificate if<br>
there are multiple and the advanced VPN options (via adapter options on<br>
Windows 10) even provide a setting to pre-select a specific certificate<br>
to use (via issuer/CA and/or EKU).<br>
<br>
Regards,<br>
Tobias<br>
<br>
<br>
</div>
</span></font>
</body>
</html>