第三方购买的证书的配置问题 about one-key-ikev2-vpn HOT 3 CLOSED

经过检查 是由于我的证书机构Root CA 和中间颁发机构的CA放在一个pem文件中了，导致没法被Win7 客户端 识别， 我把他们拆成独立文件就行了。

解决方法参见如下连接：
http://serverfault.com/questions/536092/strongswan-ikev2-windows-7-agile-vpn-what-is-causing-error-13801

I had an identical problem and solved it by ensuring I had the certificate chain in the certificate file (end-entity cert, intermediate CA, root CA - in that order). TLS is fun.
After restarting strongSwan, this stopped working, but started working again when I dropped the intermediate and root CA into /etc/ipsec.d/cacerts.

from one-key-ikev2-vpn.

@nxtreaming 是的,只需要证书颁发机构的证书即可.根证书CA已经是各种客户端内置信任的了

from one-key-ikev2-vpn.

@nxtreaming 是的,只需要证书颁发机构的证书即可.根证书CA已经是各种客户端内置信任的了

明白了。
我遇到的问题是颁发机构和根证书都在一个pem文件中，必须把它们分开才可以，否则windows下连不上。

from one-key-ikev2-vpn.