<html><head></head><body><div class="ydpf23729b9yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;"><div></div>
<div>Certutil command line:</div><div><br></div><div><span>certutil -S -c "ca.zzz.net" -n "vv.zzz.net" -s "O=VV Server Cert,CN=vv.zzz.net" -k rsa -v 12 -d sql:${HOME}/ca -t ",," -1 -6 -8 "vv.zzz.net" --extSAN ip:11.11.11.11,ip:10.0.0.194</span><br></div><div><span><br></span></div><div><span>11.11.11.11 is the elastic IP</span></div><div><span>10.x is the vpc ip</span></div><div>The domain vv.zzz.net resolves to 11.11.11.11 </div><div><br></div><div>No reverse DNS though.</div><div><br></div><div>The -8 option should set the SubjectAltName per the certutil man page, yes?</div><div><br></div><div>I'll look into the debug profile stuff.</div><div><br></div>
</div><div id="yahoo_quoted_8219994659" class="yahoo_quoted">
<div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:13px;color:#26282a;">
<div>
On Tuesday, January 22, 2019, 3:08:51 PM EST, Paul Wouters <paul@nohats.ca> wrote:
</div>
<div><br></div>
<div><br></div>
<div><div dir="ltr">On Tue, 22 Jan 2019, Mr. Jan Walter wrote:<br clear="none"><br clear="none">> NVM on the roaming clients question, the server cert needs the extended data.<br clear="none">> <br clear="none">> I generated a new vpn server cert with both the dns name, the local, and public ip address in the Alt data.<br clear="none">> <br clear="none">> I removed the esn= line from ipsec.conf, and now it gets this far, but the osx client states "authentication failed":<br clear="none"><br clear="none">Does the server cert have a SubjectAltname with vv.zzz.net ?<br clear="none"><br clear="none">For OSX, you can also install the IKEv2 debug profile. The run the test<br clear="none">and make it fail, then check the system logs. If installed on a phone,<br clear="none">connect the phone to the laptop, sync and then you should have the<br clear="none">debug logs.<div class="yqt8823212386" id="yqtfd02800"><br clear="none"><br clear="none">Paul<br clear="none"></div></div></div>
</div>
</div></body></html>