I'm running an IPSec server for road warriors. It uses public key authentication with a Let's Encrypt certificate.
Client authentication goes via EAP-RADIUS. The local FreeRADIUS uses certificate from a private CA.
Most clients here are Windows 11 built-in vpn clients.
This worked flawlessly with the LE R13 certificate. But since this was replaced by the ACME client with an YR cert, Windows fails to connect.
The reason seems to be an additional layer in the cert chain, which Windows doesn't trust:
my-cert ← R13 ← ISRG Root X1
my-cert ← YR2 ← Root YR ← ISRG Root X1
So the YR has an additional intermediate certificate: "Root YR". OPNsense shows only YR2 up in the GUI though, but if I download it, I can see both intermediate certs are stored into a single file.
So I suspect, that the vpn server only sends the first one to the client. Or Windows accepts only the first one.
The IPSec log shows
sending cert request for "C=US, O=Let's Encrypt, CN=YR2"
However, Windows fails to connect. It just stops the communication and the connection times out on the server.
Is anyone else using an LE YR or YE certificate with IPSec on OPNsense and got this working?
I assume, a workaround could be to split the intermediate cert file so that I get a unique for both and assigning them the vpn server. So that both are delivered to the client. But the intermediate cert has a limited validity. So this might be only a temporary solution.