iOS 10.2 NetworkExtension Problem (Possibly bug)

Hi,

Since I updated to iOS 10.2 I can't connect to my VPN server. Same configuration is still working totally fine with previous versions of iOS. (e.g. 10.1)

I'm using ikev2 with Strongswan and LetsEncrypt certificate and trying to connect using NEVPNManager.


This is what I got in the console:

  • Plugin com.apple.neplugin.IKEv2 does not have a bundle URL
  • sendInitCommand: failed to create a com.apple.vpn-plugin sandbox extension for /System/Library/Frameworks/NetworkExtension.framework/PluginIKEv2.vpnplugin
  • ikev2_crypto_copy_remote_certificate_authority_array: failed to retrieve remote CA cert data by CN (Let's Encrypt Authority X3)
  • Certificate authentication data could not be verified
  • Failed to process IKE Auth (EAP) packet


And this is what I got on the server (so it's working fine):

  • sending end entity cert "CN=xxxmyvpnxxx.com"
  • 16[IKE] sending issuer cert "C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3"


I created same connection manually and it works. The log looks the same, except rows below are absent (so I assume this is main problem):

  • ikev2_crypto_copy_remote_certificate_authority_array: failed to retrieve remote CA cert data by CN (Let's Encrypt Authority X3)
  • Certificate authentication data could not be verified
  • Failed to process IKE Auth (EAP) packet


Edit: I tried to manually install Issuer certificate (Let's Encrypt Authority X3) and connection works now. Can I somehow avoid this limitation? (It seems redundant to add Issuer certificate, because server certificate (xxxmyvpnxxx.com) already contains Issuer certificate and user trusts it)


Could anyone provide any help with this problem?

Thanks, Roman.

Up vote post of tsopin Down vote post of tsopin
1.6k views
Posted by
tsopin
Reply
Add a Comment

Replies

Hi,


I have exactly the same problem and have filed also a bug report (29688688) about the issue. No response so far.


I also found out this reference: https://help.apple.com/deployment/ios/#/ior95c453866: "The certificate of the certification authority (CA) that signed the server’s certificate needs to be installed on the device. If it isn’t a root certificate, install the rest of the trust chain so that the certificate is trusted. ... Sending the entire certificate trust chain by the server isn’t supported."


This seems bizarre because that's exactly how it should work: the server should send the intermediate CAs so that the client can do the verification against the trusted roots. Also in my case case the server cert is signed by an intermediate CA ("thawte DV SSL CA - G2") that is ultimately traceable to a trusted root ("thawte Primary Root CA").

Posted by
jarit
Up vote reply of jarit Down vote reply of jarit
Add a Comment

Same issue for me since 10.2. I found I had to include a specific certificate for the server rather than just using a root CA for it.

Posted by
dancudds
Up vote reply of dancudds Down vote reply of dancudds
Add a Comment

dancudds,


Which certificate did you include ( cert.pem chain.pem fullchain.pem or privkey.pem)?


And how did you include it? Like in which swift property?

Posted by
devyen936
Up vote reply of devyen936 Down vote reply of devyen936
Add a Comment