I have a problem. When I set the authentication to eap radius, I encounter a series of strange problems on Android devices, which of course are on the same strongswan.
Now I have no problems on Windows, and even Linux and iOS devices, but I have a lot of problems on Android.
First, I tried to authenticate without a certificate, just with a username and password, but no matter what I did, this was not possible. Authentication is not possible on any of the devices without entering the certificate, meaning the user must enter both the certificate and the username and password!
Part of my Android device logs
Jul 11 01:50:49 14[IKE] establishing CHILD_SA android{3}
Jul 11 01:50:49 14[ENC] generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) CERTREQ CPRQ(ADDR ADDR6 DNS DNS6) SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]
Jul 11 01:50:49 14[ENC] splitting IKE message (3344 bytes) into 3 fragments
Jul 11 01:50:49 14[ENC] generating IKE_AUTH request 1 [ EF(1/3) ]
Jul 11 01:50:49 14[ENC] generating IKE_AUTH request 1 [ EF(2/3) ]
Jul 11 01:50:49 14[ENC] generating IKE_AUTH request 1 [ EF(3/3) ]
Jul 11 01:50:49 14[NET] sending packet: from 192.168.1.169[44040] to 217.00.00.00[4500] (1364 bytes)
Jul 11 01:50:49 14[NET] sending packet: from 192.168.1.169[44040] to 217.00.00.00[4500] (1364 bytes)
Jul 11 01:50:49 14[NET] sending packet: from 192.168.1.169[44040] to 217.00.00.00[4500] (756 bytes)
Jul 11 01:50:50 13[NET] received packet: from 217.00.00.00[4500] to 192.168.1.169[44040] (1204 bytes)
Jul 11 01:50:50 13[ENC] parsed IKE_AUTH response 1 [ EF(1/2) ]
Jul 11 01:50:50 13[ENC] received fragment #1 of 2, waiting for complete IKE message
Jul 11 01:50:50 12[NET] received packet: from 217.00.00.00[4500] to 192.168.1.169[44040] (852 bytes)
Jul 11 01:50:50 12[ENC] parsed IKE_AUTH response 1 [ EF(2/2) ]
Jul 11 01:50:50 12[ENC] received fragment #2 of 2, reassembled fragmented IKE message (1680 bytes)
Jul 11 01:50:50 12[ENC] parsed IKE_AUTH response 1 [ IDr AUTH CERT EAP/REQ/ID ]
Jul 11 01:50:50 12[IKE] received end entity cert “CN=de.00000000.online”
Jul 11 01:50:50 12[CFG] using certificate “CN=de.00000000.online”
Jul 11 01:50:50 12[CFG] no issuer certificate found for “CN=de.00000000.online”
Jul 11 01:50:50 12[CFG] issuer is “C=US, O=Let’s Encrypt, CN=R11”
Jul 11 01:50:50 12[IKE] no trusted RSA public key found for ‘CN=de.00000000.online’
Jul 11 01:50:50 12[ENC] generating INFORMATIONAL request 2 [ N(AUTH_FAILED) ]
Now, another problem is that I got a Let’s Encrypt certificate and when I try to enter it into my phone or software, I get this message:
Private Key required to install a certificate
If anyone knows the way and can guide me in detail so that I don’t need a certificate, I would really appreciate it.
Of course, I mean with username and password.