I installed a user certificate and the enterprise CA onto an iOS device (iOS11). The user certificate contains UPN (User Principal Name) in its alternative subject name. I then tried to set up an certificate-based IKEv2 VPN, but if failed connecting.
On the VPN server (Windows Server 2016 RRAS + NPS) I found the log saying that "NPS server denied access because the specific account name does not exist". The account name provided by the iOS device is its IP address, while in the certificate the UPN is firstname.lastname@example.org . The same certificate will work on Windows machine.
How to make iOS provide UPN as account name?