IPSDEC NordVPN - certificate trust issue

RouterOS General
1

post by boroughopposite on Feb 24, 2023

boroughopposite

Feb 2023

NordVPN support states the following:

Unfortunately, you will not be able to set up a NordVPN connection on RouterOS version 7.5 or newer, as there is a problem with certificate importing - which is required to establish a VPN connection to our servers.

The MikroTik support team confirmed that their team is working on resolving the problem. In the meantime, you may try downgrading your RouterOS version to 7.4.1, importing the certificate (step 2 in our guide), and then upgrading the RouterOS version again.

Alternatively, you may use the working 7.4.1 RouterOS version until the problems from MikroTik’s side are resolved.

We apologize for the temporary inconvenience this may cause.

It looks the issue still exist or it is a regression.

based on https://support.nordvpn.com/hc/en-us/articles/20398642652561-MikroTik-IKEv2-setup-with-NordVPN

I had a working IPSEC solution (Mikrotik RouterOS) that works - this is no longer working due to an cert trust issue

Jul 25 23:05:11 192.168.111.5 ipsec,error darkgate: certificate is not yet valid(9) at depth:1 cert:CN=NordVPN CA11,C=,ST=,L=,O=NordVPN,OU=,SN=
Jul 25 23:05:11 192.168.111.5 ipsec,error darkgate: can't verify peer's certificate from store
Jul 25 23:05:11 192.168.111.5 ipsec,info,account darkgate: peer failed to authorize: NordVPN 192.168.111.5[4500]-146.70.62.251[4500] spi:2003b1bf17db5f8e:00a6e35740e64cde
Jul 25 23:05:11 ipsec darkgate: send notify: AUTHENTICATION_FAILED
Jul 25 23:05:11 ipsec darkgate: adding notify: AUTHENTICATION_FAILED

I uploaded the also in intermediate cert

Issuer: C = PA, O = NordVPN, CN = NordVPN Root CA
Validity
Not Before: Jan 1 00:00:00 2026 GMT
Not After : Jan 31 23:59:59 2027 GMT
Subject: O = NordVPN, CN = NordVPN CA11

/certificate import file-name=c11.der

no difference.

2

Well, the post by @boroughopposite refers to issues with import, whilst your log message says the certificate is not yet valid, i.e. its validity period starts in future as compared to the timestamp of the log message, which shows the correct month and date but doesn't state the year. So my first check would be whether your router does not live e.g. in 2025 due to a typo when manually entering time.

If /system/clock/print shows the correct date, I'd disable the peer representing NordVPN, enable detailed logging of IPsec, using /system/logging/add topic=ipsec,!packet, then run /log/print follow-only file=ipsec-start where topics~"ipsec" and enable the NordVPN peer again. Once it fails, stop the /log/print ..., download the ipsec-start.txt file, and see the details of the received certificate before the ipsec,error ... certificate is not yet valid(9), as I am not sure whether the message refers to the CA11 certificate or to the received own one of the responder.

What does certificate print detail where common-name~"CA11"show? This will reveal any eventual issues with the import.