Multi tool use

Cannot connect to Azure Point to Site VPN from MAC

I need to establish a p2s connection from a Mac against Azure.
From Azure I've downloaded the vpn client zip file with a certificate inside: VpnServerRoot.cer. I can import the certificate in keychain, but when I create the vpn on network preferences, the certificate is not shown.

After reading many documents, I've found that apart from the root certificate, a client certificate is needed. This client certificate should be generated from the root certificate. The Microsoft documentation does not include how to do that in Mac (which makes sense). So my question is how do I create a client certificate from the root certificate in Mac?
Thanks!

1 Answer
1

From Azure I've downloaded the vpn client zip file with a certificate
inside: VpnServerRoot.cer. I can import the certificate in keychain,
but when I create the vpn on network preferences, the certificate is
not shown.

The VpnServerRoot.cer is used for authenticating the VPN server on the P2S VPN connection. For MAC client, you need to import the VpnServerRoot root certificate to your Mac. Also you need to open the Network dialog under Network Preferences and click '+' to create a new VPN client connection profile for a P2S connection to the Azure VNet.

After reading many documents, I've found that apart from the root
certificate, a client certificate is needed. This client certificate
should be generated from the root certificate.

There is a client certificate that was issued by the root certificate that you uploaded to Azure when you configured you P2S settings. This is different from the VPNServerRoot that you installed in the previous step. The client root certificate is used for authenticating the users connection from azure.

So my question is how do I create a client certificate from the root
certificate in Mac?

You can generate a client certificate from either a root certificate that was generated using an Enterprise CA solution, or a self-signed root certificate. See the PowerShell or MakeCert instructions for steps. After generating client certificates, export them as .pfx files. Be sure to include the entire certificate chain when exporting.

As my explanation above, I think you have root certificate uploaded to the Azure since you have downloaded the VPN client zip file. Generally, you do not download the client zip file until you upload the root certificate to azure for a P2S setting.

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.