0

I have an IKEv2 VPN server, and run my own CA. Clients authenticate using certificates. I have prepared a .mobileconfig profile (using Apple Configurator) that sets up the IKEv2 configuration, and imports the root CA (.crt) and the client certificate (.pfx).

This profile works perfectly on macOS, but fails on iOS, and the failure mode is strange.

The server side logs are identical irrespective whether macOS or iOS is the client. In fact the server reports success in establishing the IPSec flow.

I used Console.app to compare the macOS and iOS logs. I have enabled info and debug messages, and I found the following difference. The logs are identical up to a point (they both seem to be able to create the session, etc) however at some point macOS prints this log message:

neagent IKEv2 Plugin: received notif IKE (4096) Configuration (512)  (0)  

while iOS prints this message:

neagent IKEv2 Plugin: received notif IKE (4096) Status (256) Disconnected (1)

After this message iOS will disconnect from the VPN.

What is going on, how can I debug this further? What does this message mean?

Just for debugging, I tried pre-shared keys. With pre-shared keys IKEv2 works on both macOS and iOS, however, I want to use client certificates.

I've enabled more debugging on macOS and iOS, and have more comprehensive logs. Here is what is happening on macOS:

debug   21:57:30.479681 +0100   neagent Matching remote hostname ix.mgk.ro with remote certificate
debug   21:57:30.479744 +0100   neagent create 0x7fae57803e5d for 0x7fae57803e10
debug   21:57:30.479771 +0100   neagent 0x7fae57803e10 attached module 0x7fae56635470(AppleX509CL) (ssid 0 type 8)
debug   21:57:30.479852 +0100   neagent Certificate 0:
ix.mgk.ro
debug   21:57:30.480122 +0100   trustd  XPC [neagent[41122]/1#3 LF=0] operation: trust_evaluate (8)
debug   21:57:30.484756 +0100   neagent Certificate public key: <SecKeyRef: 0x7fae57b01d40>
debug   21:57:30.484806 +0100   neagent Verifying signature with hash (null)
debug   21:57:30.485172 +0100   neagent create 0x7fae5660de6e for 0x7fae5660de20
debug   21:57:30.485197 +0100   neagent 0x7fae5660de20 attached module 0x7fae565021e0(AppleCSP) (ssid 0 type 2)
debug   21:57:30.485218 +0100   neagent create 0x7fae56630cff for 0x7fae56630cb0
debug   21:57:30.485249 +0100   neagent Empty start date
debug   21:57:30.485271 +0100   neagent Empty end date
debug   21:57:30.485717 +0100   neagent Bundle: <private>, key: -2147415734, value: -2147415734, table: SecErrorMessages, localizationName: (null), result: -2147415734
debug   21:57:30.485768 +0100   neagent Bundle: <private>, key: -2147415734, value: -2147415734, table: SecDebugErrorMessages, localizationName: (null), result: CSSMERR_CSP_VERIFY_FAILED
default 21:57:30.485804 +0100   neagent CSSM Exception: -2147415734 CSSMERR_CSP_VERIFY_FAILED
debug   21:57:30.486187 +0100   neagent 0   Security                            0x00007fff3ad8c323 Security::CommonError::LogBacktrace() + 87
debug   21:57:30.486217 +0100   neagent 1   Security                            0x00007fff3ac6f6a4 Security::CssmError::CssmError(int, bool) + 296
debug   21:57:30.486276 +0100   neagent 2   Security                            0x00007fff3ab5952c Security::CssmError::throwMe(int) + 36
debug   21:57:30.486296 +0100   neagent 3   Security                            0x00007fff3ab625d0 RSASigner::verify(void const*, unsigned long, void const*, unsigned long) + 556
debug   21:57:30.486314 +0100   neagent 4   Security                            0x00007fff3ab62352 SignatureContext::final(Security::CssmData const&) + 82
debug   21:57:30.486332 +0100   neagent 5   Security                            0x00007fff3ab618ae cssm_VerifyData(long, unsigned long long, cssm_context const*, cssm_data const*, unsigned int, unsigned int, cssm_data const*) + 129
debug   21:57:30.486347 +0100   neagent 6   Security                            0x00007fff3ab61793 CSSM_VerifyData + 138
debug   21:57:30.486370 +0100   neagent 7   Security                            0x00007fff3ad70bf7 __VerifyTransform_block_invoke.81 + 332
debug   21:57:30.486386 +0100   neagent 8   Security                            0x00007fff3ad70d51 __VerifyTransform_block_invoke.89 + 86
debug   21:57:30.486403 +0100   neagent 9   Security                            0x00007fff3ad73251 CustomTransform::AttributeChanged(void const*, void const*) + 407
debug   21:57:30.486419 +0100   neagent 10  Security                            0x00007fff3ad7beec Transform::Do(void const*, void const*) + 332
debug   21:57:30.486435 +0100   neagent 11  Security                            0x00007fff3ad7bd7c invocation function for block in Transform::SetAttribute(void const*, void const*) + 26
debug   21:57:30.486450 +0100   neagent 12  libdispatch.dylib                   0x00007fff5c2bfd53 _dispatch_call_block_and_release + 12
debug   21:57:30.486465 +0100   neagent 13  libdispatch.dylib                   0x00007fff5c2c0dcf _dispatch_client_callout + 8
debug   21:57:30.486499 +0100   neagent 14  libdispatch.dylib                   0x00007fff5c2c7124 _dispatch_lane_serial_drain + 618
debug   21:57:30.486547 +0100   neagent 15  libdispatch.dylib                   0x00007fff5c2c7c0c _dispatch_lane_invoke + 436
debug   21:57:30.486573 +0100   neagent 16  libdispatch.dylib                   0x00007fff5c2c6fc9 _dispatch_lane_serial_drain + 271
debug   21:57:30.486602 +0100   neagent 17  libdispatch.dylib                   0x00007fff5c2c7bdc _dispatch_lane_invoke + 388
debug   21:57:30.486634 +0100   neagent 18  libdispatch.dylib                   0x00007fff5c2d0090 _dispatch_workloop_worker_thread + 603
debug   21:57:30.486672 +0100   neagent 19  libsystem_pthread.dylib             0x00007fff5c50160b _pthread_wqthread + 409
debug   21:57:30.486706 +0100   neagent 20  libsystem_pthread.dylib             0x00007fff5c501405 start_wqthread + 13
info    21:57:30.486859 +0100   neagent Peer certificate is valid

Notice the CSSM Exception (and associated stack trace), but eventually the cert is deemed valid.

And here is iOS:

debug   21:38:57.111478 +0100   neagent Certificate public key: <SecKeyRef algorithm id: 1, key type: RSAPublicKey, version: 4, block size: 2048 bits, exponent: {hex: 10001, decimal: 65537}, modulus: C5D54AD0FE7200905DC960BA5216D5E64ED3571D8717832361CE721BE6398F8035F3679D8D84E8D1D9F3FC634EE8BE7FB6B1E8C55918635A7976F02823DB76DF2DE9F473C3BEE5C9CDEE958C0AAA04B081092F3A3CD7175C25DAD3AB652375A2E74913DFEDD3F86E019CCB1FBE3EA76D57C43EBC52685D829ED2694B90F7E7C82A3567E1FF20BD2E61A6712D48264EC89374E305EE001B52C06371D21BBD975DE5FD049E39738076572D0342F05A1A1A2677EDCD64A35BFA48056BBAEEF3B20F8438F4F446FF4C404DB7BB3166E704985FF3AAEE1CD0B6BAF42429604101F94BCE0E2C26027E9300D355B17C6C2AB9F93ACB361DE9C75B638877F2EC4E9E338F, addr: 0x102606720>
debug   21:38:57.111605 +0100   neagent Verifying signature with hash (null)
error   21:38:57.111807 +0100   neagent Failed to verify signature with hash (null)
debug   21:38:57.111894 +0100   neagent Verifying signature with hash SHA-256-HASH
error   21:38:57.112222 +0100   neagent Failed to verify signature with hash SHA-256-HASH
error   21:38:57.112285 +0100   neagent failed to verify signature
error   21:38:57.112340 +0100   neagent Could not verify signature
error   21:38:57.112394 +0100   neagent Certificate authentication data could not be verified
error   21:38:57.112467 +0100   neagent Failed to process IKE Auth packet (connect)

It seems iOS can't validate the cert for whatever reason.

  • On your iOS device, under Settings > General > Profiles, do the root and client certificates display as verified and trusted? – not2savvy Feb 23 at 14:07
  • They display fine (all information displayed is correct), however, it doesn't say anything about trust or verification. – Aram Hăvărneanu Feb 24 at 12:32
  • I don’t know the exact wording in the English UI, but if you look at the certificate, they should display a green check symbol under the „signed by“ with a text similar to „Verified“. – not2savvy Feb 24 at 13:15
  • Not sure how it should look like: i.imgur.com/vNigCOZ.png. – Aram Hăvărneanu Feb 26 at 12:44
  • Click on the certificate. The next page should display what I‘m asking for. – not2savvy Feb 26 at 12:48

You must log in to answer this question.

Browse other questions tagged .