I am trying to setup ikev2 with strongswan using a wildcard certificate.

The config seems to work for iOS with this certificate but doesn't work for Android, getting this error - no trusted rsa public key found '$IP'

did anyone face this issue ? if i understood correctly the public rsa key is the crt file which is the certs chain. I've added it but no luck.

  • Do you have the host certificate installed in /etc/ipsec.d/cacerts on the client? – Laucktba May 19 '17 at 9:05
  • it's the whole chain there – Vitalik Jimbei May 19 '17 at 11:03

The strongSwan Android app enforces that the configured server address/hostname is contained in the certificate as subjectAltName. If that's not the case you have to configure the server identity manually in the VPN profile, either to a subjectAltName that's actually contained in the certificate (if the server finds a config with that identity) or to the full subject DN of the server certificate (again the server has to find a config for that identity).

Generally, strongSwan doesn't support wildcard certificates (see e.g. #794). For instance, if the certificate contains *.example.com as subjectAltName strongSwan won't match vpn.example.com against that.

  • but how then the cert works with iOS ? – Vitalik Jimbei May 19 '17 at 11:02
  • iOS has its own IKEv2 implementation and they apparently decided to match identities against wildcard certificates (they also match identities against commonNames of DNs, which strongSwan doesn't do). – ecdsa May 19 '17 at 13:15
  • i've seen a vpn provider that uses wild certs and works on android using wilcard cert – Vitalik Jimbei May 22 '17 at 7:33
  • Are you sure they don't also add other FQDNs or IPs as subjectAltName extension? Or that they don't use a customized client? – ecdsa May 22 '17 at 13:05
  • no customized client, strongswan's one. what do you mean by " as subjectAltName extension" ? – Vitalik Jimbei May 22 '17 at 13:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.