FireBrick Road Warrior Certificate Authentication
It is possible to use Client Certificate authentication instead of using EAP Users. This method may be preferable to some, as your EAP password is not viewable from the FireBrick's configuration.
This page is a work-in-progress and is not currently complete.
Step 1 - Generating Certificates
Follow the guidance at FireBrick Road Warrior Certificates to generate the usual set of certificates required for Road Warrior.
Generate a Client Key
Using the make-key script you used during the previous steps to generate your certificates, you will need to generate a Client Key for your device.
Generate the Client Certificate
Using a tool such as wget, download the make-client-cert script. This is a modified version of the make-cert script that changes extended=extendedKeyUsage=serverAuth to extended=extendedKeyUsage=clientAuth, to generate the client certificate.
Once downloaded, run the script to generate your Client Certificate, remembering to change the FQDN to the one you are using for your FireBrick.
./make-client-cert DN="/C=GB/O=Server/CN=server.example.com" FQDN=server.example.com KEY=client-key.pem ISSUER-KEY=ca-key.pem ISSUER=ca-cert.pem client-cert.pem
Convert your Client Certificate to a PKCS#12 file
The .pfx file, in PKCS #12 format is your actual Client Certificate that you will install on the end-device, such as Android or iOS.
openssl pkcs12 -export -out client.pfx -inkey client-key.pem -in client-cert.pem -certfile ca-cert.pem
Remember to set a password on this - you will need to use it when you import the certificate to your device.
Step 2 - Configuring the FireBrick
Upload keys to FireBrick
Upload your client-cert.pem and client-key.pem to the FireBrick.
Add the IPSec configuration
The configuration of the FireBrick is much the same as the configuration for using EAP secrets at FireBrick Road Warrior FireBrick Config, but with two changes:
- peer-auth-method is set to "Certificate" rather than EAP
- no need to add any EAP users.
<ipsec-ike> <connection name="server" roaming-pool="roam-pool" auth-method="Certificate" peer-auth-method="Certificate" mode="Wait" local-ID="FQDN:server.example.com"/> <roaming name="roam-pool" ip="[ranges of LAN IPs]" DNS="[DNS, e.g. 22.214.171.124]"/> </ipsec-ike>
Step 3 - Configuring Devices
Android, via StrongSwan
Before configuring StrongSwan, you will need to copy your CA certificate (in PEM format, ca-cert.pem in this example), and your client certificate (PKCS#12 .pfx format, client.pfx in this example) to your phone.
Once copied, open the StrongSwan app, and click "ADD VPN PROFILE" at the top right corner of the screen.
Fill out the following details:
- Server: enter your fully-qualified domain name to connect to your FireBrick.
- VPN Type: Change this to "IKEv2 Certificate"
- User Certificate: Press the "INSTALL" button, and using the file browser on your phone, navigate to where you put your certificate, in this example it is "client.pfx". You will be prompted for the password you set earlier when you generated this certificate, enter this password at this point.
- User identity: Change this from "Default", to the FQDN of your FireBrick.
- CA certificate: Untick "Select automatically", and select "Select CA certificate" that will appear below this box when unticked. Once the CA certificates window is open, press the menu button on the top right, and select import certificate. Select your CA certificate here. Once imported, select the "IMPORTED" option from the top right of your screen, and select your newly-imported CA certificate.
Once these details are filled in, press Save from the top right corner. Your VPN profile should now be listed in StrongSwan, and you should be able to connect to it.