How do I make or get computer certificates to use with IPSEC user authentication on Windows?

Question

I am having trouble and need some direction using computer certificates with Windows 7 firewall IP Security rules, using certificates only for user authentication. I can get everything to work correctly using a passphrase for user authentication. However, I would like to use certificates.

I cannot find any documentation on the requirements to make certificates for IPSEC user authentication.

I have been using makecert to create the third party CA then made some certificates using the following ekus:

Server Authentication EKU is        1.3.6.1.5.5.7.3.1
IP security IKE intermediate EKU is 1.3.6.1.5.5.8.2.2
Client Certificate EKU is           1.3.6.1.5.5.7.3.2

Does anyone know of a good resource or documentation for Windows 7 firewall that includes this message? Or has anyone created these kind of certificates before and would be willing to assist me?

Answer 1

In terms of making the certificates and requiring the server to use certificate authentication, have a look at this resource: http://support.microsoft.com/kb/814394

In order to get the certificates, the following is a handy way to do it over HTTPS so you won't need to get into reconfiguring firewall rulesets to permit: https://blogs.technet.com/b/askds/archive/2010/02/01/certificate-enrollment-web-services.aspx?Redirected=true

Answer 2

I have just established an IPSEC site-to-site VPN that required some ExtendedKeyUsage and I did some research on it.

The ExtendedKeyUsage for Internet Key Exchange were deprecated by RFC4945

The CA SHOULD NOT include the ExtendedKeyUsage (EKU) extension in certificates for use with IKE. Note that there were three IPsec-
related object identifiers in EKU that were assigned in 1999. The
semantics of these values were never clearly defined. The use of
these three EKU values in IKE/IPsec is obsolete and explicitly
deprecated by this specification. CAs SHOULD NOT issue certificates
for use in IKE with them. (For historical reference only, those
values were id-kp-ipsecEndSystem, id-kp-ipsecTunnel, and id-kp-
ipsecUser.)

If this certificate will be used only for IKE/IPSEC, the recommendation is to set the KeyUsage to digitalSignature, nonRepudiation or both.

IKE uses an end-entity certificate in the authentication process. The end-entity certificate may be used for multiple applications. As such, the CA can impose some constraints on the manner that a public key ought to be used. The KeyUsage (KU) and ExtendedKeyUsage (EKU) extensions apply in this situation.

Since we are talking about using the public key to validate a
signature, if the KeyUsage extension is present, then at least one of the digitalSignature or the nonRepudiation bits in the KeyUsage
extension MUST be set (both can be set as well). It is also fine if
other KeyUsage bits are set.

A summary of the logic flow for peer cert validation follows:

o If no KU extension, continue.

o If KU present and doesn't mention digitalSignature or nonRepudiation (both, in addition to other KUs, is also fine), reject cert.

o If none of the above, continue.