Hi Bob,<br><br>I have openswan working with X509 certificates and L2tp on both IOS and OSX. If you're using OSX 10.8, you need to replace the configuration files related to ipsec with the ones of OSX 10.7. Mountain Lion's IPsec support is a bit flawed.<br>
<br>I think you do need extended key usage for signing the connection, as I needed them to let the connection work.<br><br>I find it quite difficult to answer your question without logs and config, so if you like you can send them to me and I will take a look at them.<br>
<br>Greetings,<br><br>Bart Smink<br><br><br><br><br><div class="gmail_quote">2013/1/25 Bob Miller <span dir="ltr"><<a href="mailto:bob@computerisms.ca" target="_blank">bob@computerisms.ca</a>></span><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Greetings all,<br>
<br>
I am seeking to increase my understanding. I am not sure that I have a<br>
specific question, but if I do it is what is the magic spell that makes<br>
certificates work for mac computers connecting to openswan? Background<br>
follows:<br>
<br>
I have an openswan server that currently supports windows road warriors<br>
and a net-to-net tunnel to a satellite office. Now, there are a handful<br>
of mac computers that need to work as road warriors too.<br>
<br>
In trying to get a mac to join, I have with reasonable confidence<br>
narrowed the problem down to the certificates being the problem. At<br>
least I can connect when using PSK, and no amount of fiddling with the<br>
ipsec.conf gets me past the MAIN_R2 stage. I find no errors, just a<br>
steady looping up to MAIN_R2 then start over till everything times out.<br>
<br>
Some years ago, maybe 3 or 4, was the last time someone asked me to<br>
connect a mac to openswan. At that time I remember failing to get the<br>
mac to join because of certificate problems, and afterwards deciding it<br>
was time to get a handle on certificates. I read all the documentation<br>
and built myself an ssl.conf that was used to construct my current CA,<br>
and subsequently I have been using that CA to sign certs for windows<br>
roadwarriors, linux roadwarriors, net-to-net openswan installations,<br>
email servers, web applications; where ever I have needed certs, my<br>
setup has been working. until I come full circle to putting macs<br>
together with openswan.<br>
<br>
When I built my ssl system, I took into account the information on<br>
Jacco's most excellent web pages, in particular regarding certificate<br>
requirements for mac.<br>
<br>
Specifically:<br>
-I use subjectAltName extensively for web pages that answer to more than<br>
one name; the blackberry playbook browser, for example, will not work<br>
with a certificate that does not have SANs correctly configured. (Note:<br>
I have also, according to Jacco's page, made a hosts entry so that I am<br>
connecting to the host as it is listed in SAN on the firewall<br>
certificate). When I read the pem file for this firewall's certificate,<br>
the SAN is clearly visible.<br>
<br>
-There are no extendedKeyUsage settings in my ssl.conf. When I search<br>
the generated pem file, the string extendedKeyUsage is not found.<br>
<br>
-Jacco mentions that macs will not connect to certificates that present<br>
a certificate containing a DN as its ID. I do not remember this<br>
particular requirement from when I set up my ssl, and I am having a<br>
really hard time finding supporting documentation, but I think this<br>
means that when I set the rightid in my ipsec.conf, it needs to match<br>
the SAN and not the DN of the certificate. If I am correct, that is<br>
done, else hopefully someone will correct me.<br>
<br>
So if I have addressed all the requirements for certificates to work<br>
with a mac, why don't they work? Clearly there is at least one piece of<br>
information I am still missing to understand the problem. If the<br>
solution is embarrassingly simple, please embarrass me; it would be a<br>
small price to pay for me to finally get my head wrapped around this.<br>
<br>
In the hope that more people will read a smaller mail, I am neglecting<br>
to include config files, log entries and such. I will however readily<br>
make such information available if anyone is willing to look at it.<br>
<br>
If you are still reading: thank you<br>
if you make comments:<br>
thankyouthankyouthankyouthankyouthankyouthankyouthankyou:)<br>
<br>
<br>
--<br>
Computerisms<br>
Bob Miller<br>
<a href="tel:867-334-7117" value="+18673347117">867-334-7117</a> / <a href="tel:867-633-3760" value="+18676333760">867-633-3760</a><br>
<a href="http://computerisms.ca" target="_blank">http://computerisms.ca</a><br>
<br>
<br>
<br>
_______________________________________________<br>
<a href="mailto:Users@lists.openswan.org">Users@lists.openswan.org</a><br>
<a href="https://lists.openswan.org/mailman/listinfo/users" target="_blank">https://lists.openswan.org/mailman/listinfo/users</a><br>
Micropayments: <a href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy" target="_blank">https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a><br>
Building and Integrating Virtual Private Networks with Openswan:<br>
<a href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155" target="_blank">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a><br>
</blockquote></div><br><br clear="all"><br>-- <br><span style="font-family:Calibri,sans-serif;font-size:14px;border-collapse:collapse">**** DISCLAIMER ****<br><br>"This e-mail and any attachment thereto may contain information which is confidential and/or protected by intellectual property rights and are intended for the sole use of the recipient(s) named above. <br>
Any use of the information contained herein (including, but not limited to, total or partial reproduction, communication or distribution in any form) by other persons than the designated recipient(s) is prohibited. <br>If you have received this e-mail in error, please notify the sender either by telephone or by e-mail and delete the material from any computer".<br>
<br>Thank you for your cooperation.</span>