On Fri, 4 Nov 2022, Rodrigo Gruppelli wrote:
I couldn't import the p12 file into MacOS. When importing it, mac's Keychain
Access asks for the password of the .p12 file, even though I didn't set any
password in the certificate generation steps (just pressed <enter>). Or even if
I set some password, it still doesn't accept it, saying 'wrong password'.
Any clues on that? What would be this "proper SAN FQDN setting" ?
I'm not sure why that failed. I usually use a .mobileprofile to import
the configuration and the certificate items. I've attached a
.mobileprofile config (with the private key blob removed :)
Hope that might help you.
Paul
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
"http://www.apple.com/DTDs/PropertyList-1.0.dtd";>
<plist version="1.0">
<dict>
<key>PayloadContent</key>
<array>
<dict>
<key>IKEv2</key>
<dict>
<key>AuthenticationMethod</key>
<string>Certificate</string>
<key>ChildSecurityAssociationParameters</key>
<dict>
<key>DiffieHellmanGroup</key>
<integer>14</integer>
<key>EncryptionAlgorithm</key>
<string>AES-256-GCM</string>
<key>LifeTimeInMinutes</key>
<integer>1440</integer>
</dict>
<key>DeadPeerDetectionRate</key>
<string>Medium</string>
<key>DisableRedirect</key>
<true/>
<key>EnableCertificateRevocationCheck</key>
<integer>0</integer>
<key>EnablePFS</key>
<integer>1</integer>
<key>IKESecurityAssociationParameters</key>
<dict>
<key>DiffieHellmanGroup</key>
<integer>14</integer>
<key>EncryptionAlgorithm</key>
<string>AES-256</string>
<key>IntegrityAlgorithm</key>
<string>SHA2-512</string>
<key>LifeTimeInMinutes</key>
<integer>1440</integer>
</dict>
<key>LocalIdentifier</key>
<string>rodrigo.nohats.ca</string>
<key>PayloadCertificateUUID</key>
<string>1E2E3E4E-5E6E-7E8E-9EAE-BECEDEEEFE0E</string>
<key>RemoteAddress</key>
<string>193.110.157.148</string>
<key>RemoteIdentifier</key>
<string>vpn.nohats.ca</string>
<key>UseConfigurationAttributeInternalIPSubnet</key>
<integer>0</integer>
</dict>
<key>IPv4</key>
<dict>
<key>OverridePrimary</key>
<integer>1</integer>
</dict>
<key>PayloadDescription</key>
<string>Configures VPN settings</string>
<key>PayloadDisplayName</key>
<string>VPN</string>
<key>PayloadIdentifier</key>
<string>com.apple.vpn.managed.0B0851BB-8131-455C-BF78-EE155C18085C</string>
<key>PayloadType</key>
<string>com.apple.vpn.managed</string>
<key>PayloadUUID</key>
<string>0B0851BB-8131-455C-BF78-EE155C18085C</string>
<key>PayloadVersion</key>
<integer>1</integer>
<key>Proxies</key>
<dict>
<key>HTTPEnable</key>
<integer>0</integer>
<key>HTTPSEnable</key>
<integer>0</integer>
</dict>
<key>UserDefinedName</key>
<string>No Hats IKEv2 VPN</string>
<key>VPNType</key>
<string>IKEv2</string>
</dict>
<dict>
<key>Password</key>
<string>yourplaintextpassword</string>
<key>PayloadCertificateFileName</key>
<string>.nohats.ca.p12</string>
<key>PayloadContent</key>
<data>
b'MIIO8AIBAzCCD BLOB'
</data>
<key>PayloadDescription</key>
<string>Adds a PKCS#12-formatted certificate</string>
<key>PayloadDisplayName</key>
<string>rodrigo.nohats.ca</string>
<key>PayloadIdentifier</key>
<string>com.apple.security.pkcs12.1E2E3E4E-5E6E-7E8E-9EAE-BECEDEEEFE0E</string>
<key>PayloadType</key>
<string>com.apple.security.pkcs12</string>
<key>PayloadUUID</key>
<string>1E2E3E4E-5E6E-7E8E-9EAE-BECEDEEEFE0E</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
<dict>
<key>PayloadCertificateFileName</key>
<string>rodrigo.nohats.ca.crt</string>
<key>PayloadContent</key>
<data>
MIID/zCCAuegAwIBAgIBADANBgkqhkiG9w0BAQsFADCBoTELMAkGA1UEBhMCQ0Ex
EDAOBgNVBAgTB09udGFyaW8xDzANBgNVBAcTBk90dGF3YTEcMBoGA1UEChMTTm8g
SGF0cyBDb3Jwb3JhdGlvbjEQMA4GA1UECxMHQ2xpZW50czEgMB4GA1UEAxMXQ2Vy
dGlmaWNhdGUgQWdlbmN5IChDQSkxHTAbBgkqhkiG9w0BCQEWDmluZm9Abm9oYXRz
LmNhMCIYDzIwMTcwMTI2MDU0NzUzWhgPMjAyNzAxMjUwNTQ3NTNaMIGhMQswCQYD
VQQGEwJDQTEQMA4GA1UECBMHT250YXJpbzEPMA0GA1UEBxMGT3R0YXdhMRwwGgYD
VQQKExNObyBIYXRzIENvcnBvcmF0aW9uMRAwDgYDVQQLEwdDbGllbnRzMSAwHgYD
VQQDExdDZXJ0aWZpY2F0ZSBBZ2VuY3kgKENBKTEdMBsGCSqGSIb3DQEJARYOaW5m
b0Bub2hhdHMuY2EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDOuEI6
iRzFh98b0MVO+T9TyWFS41roki5h+yen3/8y1Zy2E5sllqteAEOlUBbCFlJlYY5t
XvF6KxvkzlGi5yME5ayXqXJu30C0ntjfUQfIQOf/+YigLJAL7EyxKmUmHuWwHqOK
FjBS9JFbnrrM+qSJpZjh+WMrk84l8pFrQQKTxFQxz4C7VWnudhYW8FLJRLq+R1mq
29adTBY3YZny0ZSmcRQP/xKPNfUHOW/IiT9by/1sQKBAxyF3nRz3PU01J7m7r48b
nKAqu7byKjDZnvWc1K3dyjuqLnVZVTO9N+CXyhjT/KkbKz+/Phfw236hu72fcMS5
e1tN+SarqwKUmCglAgMBAAGjPDA6MAwGA1UdEwQFMAMBAf8wCwYDVR0PBAQDAgGG
MB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjANBgkqhkiG9w0BAQsFAAOC
AQEAvr/wqNd3PqiJv6ScxgwOe/3VXBjn/tbYI5BV/nQPufGKmlvV+euvPn5oPX+D
gPlPMor0QET3+ptIuNtQGsMfQPM/EHsfWvxtT1jt5LaPxO4YyZotA7Z8q+EuBp5K
QIEcEbjn0Qdxin0udfjon/6BVOqGg2poUwS8kSvwRgohFBs/lXe7KOXU9/jnSOxm
orPS5Bl6HZZY3KWnNQDPoFPOX8dDMhDzJX+433V4aAuyMHN4lDn931GClbMfKJI2
1zXrC5e1mVTsLNeXfrBW+8Cu9/Tx8DL7KEt8vkHxwNaOlLq9VWWx9XnlbOpAk2GB
PHd2hJb8F2Q69WOQUtwPCLGQGA==
</data>
<key>PayloadDescription</key>
<string>Adds a CA root certificate</string>
<key>PayloadDisplayName</key>
<string>Certificate Agency (CA)</string>
<key>PayloadIdentifier</key>
<string>com.apple.security.root.F0000001-5A01-1010-1010-111111111111</string>
<key>PayloadType</key>
<string>com.apple.security.root</string>
<key>PayloadUUID</key>
<string>F0000001-5A01-1010-1010-111111111111</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
</array>
<key>PayloadDisplayName</key>
<string>No Hats IKEv2 VPN</string>
<key>PayloadIdentifier</key>
<string>com.apple.vpn.managed.DDDDDDDD-BA2E-473E-B7CF-D3DDDD7EDFDD</string>
<key>PayloadRemovalDisallowed</key>
<false/>
<key>PayloadType</key>
<string>Configuration</string>
<key>PayloadUUID</key>
<string>22222222-2344-1850-93A6-562750E7ACA1</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
</plist>
_______________________________________________
Swan mailing list
[email protected]
https://lists.libreswan.org/mailman/listinfo/swan
