Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I are trying to find a way to connect Android devices to our VPN box running Windows Sever 2008. We manage to configure a couple Android devices to connect via PPTP. However, I would like to be able to connect using L2TP/IPSec with certificates instead. I've managed to export and apply the Enterprise CA's certificate on the Android phone, but are totally lost on how to issue a machine certificate to the Android phone. Is it even possible? If so, what are steps I should take to issue the machine certificate and enable the Android phone to connect via L2TP/IPsec with certificates? Thank you for your help!

share|improve this question
what version of Android? – Bret Fisher Mar 25 '11 at 6:48

To my knowledge there is no android support for SCEP or NDES enrollment... we need to have a way to open enroll these devices through an application, but none exist to date. To my knowledge, android only supports the certificates to be installed from the SD card. It is odd to me that iphone supports NDES but android does not.

share|improve this answer

Google has this link posted about how to install certificates.On a nexus running jellybean, I used the instructions at the link below to generate the certificates and install them using adb.These instructions worked well for me to get the certs installed and test a vpn connection to a linux server running strongswan 5.0.

share|improve this answer

Looks like the Android implementation of L2TP certificate auth may not be compatible with most L2TP/IPSec VPN's:

You may have to resort to PSK, ech. Let us know if you make headway!

share|improve this answer

Posted the same question on Microsoft Technet and received a suggestion on trying to enroll the Android device using Windows 2008's Network Device Enrollment Service. Unfortunately, I am unaware of any device administration software on Android that will allow me to create RSA public/private key pair and submit them for enrollment request to my CA. Any suggestions, or is this a dead end? I am testing this is HTC EVO 4G, Android 2.2.

share|improve this answer

I've managed to get certificates onto an Android running FroYo by emailing the cert to an address the phone can access. Opening the attached certificate from the mail client resulted in installation.

Unfortunately, Android FroYo doesn't properly support Cisco VPN, so I didn't get a sucessful test however - but the certs certainly appeared to be there.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.