pfSense » pfSense Packages

In fact this started as a forum post, but there were no replies:

https://forum.netgate.com/topic/169207/ecdsa-certificate-and-ipsec

I will gather up the exact settings...

So my CA was created as follows:

- descriptive name: `MyCo IPSec CA`
- method: `create an internal CA`
- Trust Store: `off`
- Randomize Serial: `on`
- key type: `ECDSA` / `prime256v1`
- digest algorithm: `sha512`
- lifetime: `730 days` (2 years)
- Common name: `MyCo IPSec CA`
- country code: `CA`
- state: `Quebec`
- city: `Montreal`
- organization: `MyCo Inc.`
- Organization unit: <blank>

My certificate that worked was created as follows:

- method: `create an internal certificate`
- descriptive name: `MyCo IPSec`
- certificate authority: `MyCo IPSec CA`
- key type: `RSA` / `4096`
- digest algorithm: `sha512`
- lifetime: `365 days` (1 years)
- Common name: `vpn.myco.com`
- certificate type: `server certificate`
- in 'alternative names', add 2 items:
- the same hostname: `vpn.myco.com`
- the public IPv4 address: `w.x.y.z`

If I change only the key type to `ECDSA` / `prime256v1` then it fails.

My P1 settings are:

- key exchange version: IKEv2
- internet protocol: IPv4
- interface: WAN

- authentication method: EAP-MSChapv2
- My identifier: distinguished name / vpn.myco.com
- peer identifier: any
- my certificate: MyCo CA

- encrpytion algo:
- AES256-GCM / 128 bits / SHA384 / 20
- AES / 256 / SHA256 / 14

- life time: 28800
- rekey: 25920
- reauth: 0
- rand time: 2880

- Child SA Close Action: default
- NAT Traversal: auto
- MOBIKE: enabled
- Gateway duplicates: off
- Split connections: off
- PRF Selection: off
- Custom IKE/NAT-T Ports: <blank>
- Dead Peer Detection: on
- Delay: 10
- Max failures: 5

I can't reproduce that here. So long as I have the CA imported to the client, I can use either kind of certificate. I've tried from Windows and Android. It is likely an issue with your clients, and may well be due to their age.

Hmmm, interesting. So maybe it is because of the old macOS 10.13 client. Best case, we'll be able to update the pfsense docs and not need to touch code. :)

Tomorrow my new CA/cert goes live, after that's stable for a few days, I'll try changing it again and test with newer macOS versions. At least it works with the CA being ECDSA, so I won't have to give all users a new CA all over again.

Thanks for the speedy triage.

Hi @Jim Pingle

Today we reproduced the same issue with newer macOS, namely Sierra(10) and Monterey(12) using the same IPSec configuration i.e. I can't connect to the VPN with a certificate signed by the same CA if the certificate uses a `Key type`: ECDSA/prime256v1 OR ECDSA/secp384r1.

However if I use a cert. signed by the same CA but this time using a `Key Type`: RSA, it can connect with >= macOS10.

I haven't tested with Windows but I will do so tomorrow and will post again here with the results

Jim, thanks for investigating. Note however that we're not using the profile wizard at all. Does that mean ECDSA is impossible without using it?

Sean McBride wrote in #note-8:

Jim, thanks for investigating. Note however that we're not using the profile wizard at all. Does that mean ECDSA is impossible without using it?

You would have to use a profile, either made using the Apple profile utilities or the built-in Wizard. Otherwise you are stuck with whatever defaults Apple used. The only way to deviate from those defaults is via profiles.

Apologies for the delay and the resurrection.

I have now tested my ECDSA cert with Windows 10 and it worked flawlessly, in fact I can even change certificates on my P1 tunnel config, from RSA type to ECDSA and vice versa, and the Windows 10 client stays connected.

I noticed that you created a separated ticket for the Apple profile and ECDSA cert, please let me know if I can be of help with testing this matter.

Thanks again for investigating!

Alex Sensation wrote in #note-10:

I noticed that you created a separated ticket for the Apple profile and ECDSA cert, please let me know if I can be of help with testing this matter.

I didn't make a new issue, I changed this one so it had the correct details to fit the underlying problem. So you can just keep following this one until it's resolved. I don't have an ETA for when it might be fixed, but in the meantime it is simple to add the key/value pair I mentioned into the profile by hand and get it working.

Tested on the MacOS Monterey, Version 12.6.3.

I defined certs on pfSense using ECDSA instead of RSA. IPsec Authentication Method - EAP-MSChapv2.

After exporting the config using the IPsec Export: Apple Profile I was able to connect with no issues.

I'll test the other Authentication Methods soon.