no trusted rsa public key found

Question

I am trying to setup ikev2 with strongswan using a wildcard certificate.

The config seems to work for iOS with this certificate but doesn't work for Android, getting this error - no trusted rsa public key found '$IP'

did anyone face this issue ? if i understood correctly the public rsa key is the crt file which is the certs chain. I've added it but no luck.

Do you have the host certificate installed in /etc/ipsec.d/cacerts on the client? — Laucktba, May 19 '17 at 09:05

score 2 · Accepted Answer · answered May 19 '17 at 10:23

2

The strongSwan Android app enforces that the configured server address/hostname is contained in the certificate as subjectAltName. If that's not the case you have to configure the server identity manually in the VPN profile, either to a subjectAltName that's actually contained in the certificate (if the server finds a config with that identity) or to the full subject DN of the server certificate (again the server has to find a config for that identity).

Generally, strongSwan doesn't support wildcard certificates (see e.g. #794). For instance, if the certificate contains *.example.com as subjectAltName strongSwan won't match vpn.example.com against that.

answered May 19 '17 at 10:23

ecdsa

3,800
12
26

but how then the cert works with iOS ? – Vitalik Jimbei May 19 '17 at 11:02
iOS has its own IKEv2 implementation and they apparently decided to match identities against wildcard certificates (they also match identities against commonNames of DNs, which strongSwan doesn't do). – ecdsa May 19 '17 at 13:15
i've seen a vpn provider that uses wild certs and works on android using wilcard cert – Vitalik Jimbei May 22 '17 at 07:33
Are you sure they don't also add other FQDNs or IPs as subjectAltName extension? Or that they don't use a customized client? – ecdsa May 22 '17 at 13:05
no customized client, strongswan's one. what do you mean by " as subjectAltName extension" ? – Vitalik Jimbei May 22 '17 at 13:46
What's unclear about that? – ecdsa May 23 '17 at 06:52
googled some more, all clear :) – Vitalik Jimbei May 24 '17 at 06:44

no trusted rsa public key found

1 Answers1