Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an ASA that's providing IPsec VPN services using certificate authentication (no xauth, just the certs). It works perfectly with the Cisco IPsec VPN Client. Now I'm trying to let iPhones connect.

I've installed the CA cert and a client certificate on the iPhone with a profile using iPCU, along with the VPN configuration. Then connecting gives the error "Could not validate the server certificate". Additionally, the ASA logs the error "Received encrypted Oakley Informational packet with invalid payloads".

FWIW, I receive the same invalid payload error when trying to use the Snow Leopard IPsec client to connect.

Has anyone successfully gotten the iPhone IPsec client to work with certificate auth?

share|improve this question

2 Answers 2

up vote 5 down vote accepted

To expand upon Simon's answer the iPhone requires that the subjectAltName of the VPN Server's certificate match either the hostname (it will check through dns) or the IP address of the server to which you're trying to connect. If this does not match you will get the "Could not validate server certificate" error. I was having this same problem and it took me hours to discover that extra proprietary bit.

share|improve this answer
    
I haven't looked at this in months, but this sounds like it's probably the solution. –  Ben Jencks Oct 19 '10 at 18:23
    
When you say 'it will check through dns'.. Does it require reverse dns to match the hostname? I am trying to do this with a dynamic ip from my ISP. –  joet3ch May 11 '11 at 14:36

The "could not validate the server certificate" error is where the host name on the certificate being sent back to iPhone does not match what the VPN settings say on the iPhone

And yes, I have got it to work :-)

I haven't got around the issue where it all connects fine and then prompts for their AD username and password, but I will have resolved this later this afternoon

Cheers Si

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.