Requirements for certificates used with Windows 7 » History » Version 6
Version 5 (Andreas Steffen, 12.05.2009 12:00) → Version 6/13 (charchess ney, 02.06.2010 08:34)
h1. Requirements for certificates used with Windows 7
The Windows 7 Beta release was liberal in accepting certificates, but the Release Candidate adds new requirements for the VPN gateway certificate.
h2. Required fields
Your gateway certificate must have:
* An *Extended Key Usage* flag explicitly allowing the certificate to be used for authentication purposes. It is currently unclear which OIDs are accepted by Windows, but it seems that the *serverAuth* EKU having the OID _1.3.6.1.5.5.7.3.1_ (often called _TLS Web server authentication_) is ok. If you are using OpenSSL to generate your certificates then include the option
<pre>
extendedKeyUsage = serverAuth
</pre>
In Windows 7, you now have to add the "IP Security IKE Intermediate", this is done by adding the oid : 1.3.6.1.5.5.8.2.2 as extendedKeyUsage (a good page about ikev2/windows understanding is "this one":http://www.carbonwind.net/blog/post/VPN-Reconnect-in-Windows-7-RC-redux.aspx )
Which give extendedKeyUsage = serverAuth, 1.3.6.1.5.5.8.2.2
* The hostname of the VPN gateway entered in the clients connection properties *MUST* be contained either in the *subjectDistinguishedName* of the server certificate
<pre>
C=CH, O=strongSwan Project, CN=vpn.strongswan.org
</pre>
or in a *subjectAltName* extension that can be added with the option
<pre>
subjectAltName = DNS:vpn.strongswan.org
</pre>
h2. Disabling extended certificate checks
Alternatively, you may disable these extended certificate checks on the client.
> *This is potentially dangerous, as any certificate holder assured by your CA may act as the VPN gateway.*
To disable the extended checks, add a _DWORD_ called *DisableIKENameEkuCheck* to
<pre>
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RasMan\Parameters\
</pre>
in the client's registry.
h2. Further information
For more details about the requirements and other ways to disable the certificate checks, have a look to "this knowledge base article":http://support.microsoft.com/kb/926182.
The Windows 7 Beta release was liberal in accepting certificates, but the Release Candidate adds new requirements for the VPN gateway certificate.
h2. Required fields
Your gateway certificate must have:
* An *Extended Key Usage* flag explicitly allowing the certificate to be used for authentication purposes. It is currently unclear which OIDs are accepted by Windows, but it seems that the *serverAuth* EKU having the OID _1.3.6.1.5.5.7.3.1_ (often called _TLS Web server authentication_) is ok. If you are using OpenSSL to generate your certificates then include the option
<pre>
extendedKeyUsage = serverAuth
</pre>
In Windows 7, you now have to add the "IP Security IKE Intermediate", this is done by adding the oid : 1.3.6.1.5.5.8.2.2 as extendedKeyUsage (a good page about ikev2/windows understanding is "this one":http://www.carbonwind.net/blog/post/VPN-Reconnect-in-Windows-7-RC-redux.aspx )
Which give extendedKeyUsage = serverAuth, 1.3.6.1.5.5.8.2.2
* The hostname of the VPN gateway entered in the clients connection properties *MUST* be contained either in the *subjectDistinguishedName* of the server certificate
<pre>
C=CH, O=strongSwan Project, CN=vpn.strongswan.org
</pre>
or in a *subjectAltName* extension that can be added with the option
<pre>
subjectAltName = DNS:vpn.strongswan.org
</pre>
h2. Disabling extended certificate checks
Alternatively, you may disable these extended certificate checks on the client.
> *This is potentially dangerous, as any certificate holder assured by your CA may act as the VPN gateway.*
To disable the extended checks, add a _DWORD_ called *DisableIKENameEkuCheck* to
<pre>
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RasMan\Parameters\
</pre>
in the client's registry.
h2. Further information
For more details about the requirements and other ways to disable the certificate checks, have a look to "this knowledge base article":http://support.microsoft.com/kb/926182.