Community discussions

MikroTik App
 
amarton
just joined
Topic Author
Posts: 2
Joined: Thu Nov 30, 2023 10:03 pm

IKEv2 VPN Certificate issues on Windows

Thu Nov 30, 2023 10:22 pm

Hi,

I have created a certificate and a VPN server on my mikrotik router based on this tutorial:
https://jcutrer.com/howto/networking/mi ... n-mikrotik

I had to modify the tutorial a bit with a help of several forums, since Router OS changed meanwhile. I also used different certificate creation based on some forum post.

My problem is, that in iOS and macOS connecting to the VPN with these certs works like a charm, but not on windows. When I try to connect to the router on windows I get the following error on the router's log:
<ipsec,error identity not found for peer: DER DN: CN=vpn.client,C=HU,ST=state,L=locality,O=xx,OU=organization-unit,SN
I suppose the client cert needs to contain some other stuff for windows, but I do not know. Could someone help me, what could be the issue here?

My certification creation code is here:
# Certificate Authority
/certificate add name=my.ca common-name=my.ca key-usage=key-cert-sign,crl-sign trusted=yes
/certificate sign my.ca

# Server cert
/certificate add name=vpn.server common-name=vpn.server country=HU days-valid=365 key-size=2048 locality=locality organization=xx state=state trusted=yes unit=organization-unit subject-alt-name=DNS:vpn.server
/certificate sign vpn.server ca=my.ca
/certificate set trusted=yes vpn.server

# Client cert
/certificate add name=vpn.client common-name=vpn.client country=HU days-valid=365 key-size=2048 locality=locality organization=xx state=state trusted=yes unit=organization-unit subject-alt-name=DNS:vpn.client
/certificate sign vpn.client ca=my.ca
/certificate set trusted=yes vpn.client

# Exporting the two cert
/certificate export-certificate my.ca
/certificate export-certificate vpn.client export-passphrase=blablabla type=pkcs12
 
wfburton
Frequent Visitor
Frequent Visitor
Posts: 81
Joined: Mon Apr 10, 2023 1:09 am

Re: IKEv2 VPN Certificate issues on Windows

Fri Dec 01, 2023 12:17 am

Will this help?

https://www.pcwrt.com/2019/10/how-to-se ... ntication/

Use machine certificate
 
amarton
just joined
Topic Author
Posts: 2
Joined: Thu Nov 30, 2023 10:03 pm

Re: IKEv2 VPN Certificate issues on Windows

Sat Dec 02, 2023 10:55 pm

Unfortunately no, I set the VPN in the same way as that tutorial suggested, the error and it's message are the same.

So one thing what I cannot understand is that, I cannot set remote id and client id as on mac and I cannot choose explicitly which cert I wanna use for this connection. Or I just could not find the setting, but then it is hidden well..

Other ideas why the connection fails on windows with the above error message?

Here are my settings what I use for windows:
I cannot change the "type of sing-in info" because it always reverts back to the "general auth method" after saving a different configuration.
Image
Image
 
sindy
Forum Guru
Forum Guru
Posts: 10229
Joined: Mon Dec 04, 2017 9:19 pm

Re: IKEv2 VPN Certificate issues on Windows

Sun Dec 03, 2023 12:31 pm

If you have multiple machine certificates on that machine, maybe this is what you are looking for?

Who is online

Users browsing this forum: baragoon, biomesh, regisc and 60 guests