IPsec Certificate Matching & Remote-ID Clarification Needed

RouterOS General
1

I've been configuring IPsec recently, but I'm completely confused about the ID matching logic. Could any experts here help explain the following:

1. When both sides specify local and remote certificates, is it possible to use match-by=remote-id? I've tried various combinations without success.
2. When both sides specify local and remote certificates and match-by=certificate is selected, does the remote-id become meaningless? It seems to connect successfully no matter what I put in that field.
3. Can multiple clients share the same certificate? If so, how should the matching rules be configured in this scenario?

@CGGXANNX, I'd be really grateful if you could provide a professional and detailed explanation. Thanks in advance!

2

Since the pinged person hasn't reacted to your request for clarifications (probably hasn't seen the ping), I'll attempt to answer your questions.

  1. Yes, it is possible for both routers to match by remote-id without them needing the remote certificate. If it doesn't work when remote-id is set to auto, something like the CN of the respective remote certificate should be used. E.g.:

Initiator:

/ip ipsec identity
add auth-method=rsa-signature match-by=remote-id remote-id="key-id:CN="responder_cert_CN""

Responder:

/ip ipsec identity
add auth-method=rsa-signature match-by=remote-id remote-id="key-id:CN="initiator_cert_CN""
  1. Correct. Remote-id geys ignored in that case
  2. They can share the same certificate but they cannot connect to the server at the same server