To list the names of existing IKEv2 clients, run the helper script with the --listclients option. Use option -h to show usage.
sudo ikev2.sh --listclients
To generate certificates for additional IKEv2 clients, run the helper script with the --addclient option. To customize client options, run the script without arguments.
sudo ikev2.sh --addclient [client name]
Alternatively, you may manually add a client certificate. Refer to step 4 in this section.
By default, the IKEv2 helper script exports client configuration after running. If later you want to export an existing client, you may use:
sudo ikev2.sh --exportclient [client name]
Important: Deleting a client certificate from the IPsec database WILL NOT prevent VPN client(s) from connecting using that certificate! For this use case, you MUST revoke the client certificate instead of deleting it.
First, read the important note above.
Warning: The client certificate and private key will be permanently deleted. This cannot be undone!
To delete an existing client:
sudo ikev2.sh --deleteclient [client name]
Alternatively, you can manually delete a client certificate.
List certificates in the IPsec database:
certutil -L -d sql:/etc/ipsec.d
Example output:
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
IKEv2 VPN CA CTu,u,u
($PUBLIC_IP) u,u,u
vpnclient u,u,u
Delete the client certificate and private key. Replace "Nickname" below with the nickname of the client certificate you want to delete, e.g. vpnclient.
certutil -F -d sql:/etc/ipsec.d -n "Nickname"
certutil -D -d sql:/etc/ipsec.d -n "Nickname" 2>/dev/null
(Optional) Delete the previously generated client configuration files (.p12, .mobileconfig and .sswan files) for this VPN client, if any.
In certain circumstances, you may need to revoke a previously generated VPN client certificate.
To revoke an existing client:
sudo ikev2.sh --revokeclient [client name]
Alternatively, you can manually revoke a client certificate.
This can be done using crlutil. See example steps below, commands must be run as root.
1. Check the database, and identify the nickname of the client certificate you want to revoke.
certutil -L -d sql:/etc/ipsec.d
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
IKEv2 VPN CA CTu,u,u
($PUBLIC_IP) u,u,u
vpnclient-to-revoke u,u,u
In this example, we will revoke the certificate with nickname vpnclient-to-revoke, issued by IKEv2 VPN CA.
2. Find the serial number of this client certificate.
certutil -L -d sql:/etc/ipsec.d -n "vpnclient-to-revoke"
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
00:cd:69:ff:74
... ...
From the output, we see that the serial number is CD69FF74 in hexadecimal, which is 3446275956 in decimal. It will be used in the next steps.
3. Create a new Certificate Revocation List (CRL). You only need to do this once for each CA.
if ! crlutil -L -d sql:/etc/ipsec.d -n "IKEv2 VPN CA" 2>/dev/null; then
crlutil -G -d sql:/etc/ipsec.d -n "IKEv2 VPN CA" -c /dev/null
fi
CRL Info:
:
Version: 2 (0x1)
Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption
Issuer: "O=IKEv2 VPN,CN=IKEv2 VPN CA"
This Update: Sat Jun 06 22:00:00 2020
CRL Extensions:
4. Add the client certificate you want to revoke to the CRL. Here we specify the certificate's serial number in decimal, and the revocation time in GeneralizedTime format (YYYYMMDDhhmmssZ) in UTC.
crlutil -M -d sql:/etc/ipsec.d -n "IKEv2 VPN CA" <<EOF
addcert 3446275956 20200606220100Z
EOF
fi
CRL Info:
:
Version: 2 (0x1)
Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption
Issuer: "O=IKEv2 VPN,CN=IKEv2 VPN CA"
This Update: Sat Jun 06 22:02:00 2020
Entry 1 (0x1):
Serial Number:
00:cd:69:ff:74
Revocation Date: Sat Jun 06 22:01:00 2020
CRL Extensions:
Note: If you want to remove a certificate from the CRL, replace addcert 3446275956 20200606220100Z above with rmcert 3446275956. For other crlutil usage, read here.
5. Finally, let Libreswan re-read the updated CRL.
ipsec crls