I'm building a network that will allow employees and customers to access the company systems. To that end I'm using a Red Hat Enterprise Linux (RHEL) 7.0 server as a firewall/authentication server. Initially for test purposes I'm going to use self-signed certificates. The operational scenario is the client system (Windows 7/8) establishing a VPN/IKEv2 session with the server.
I have to distribute a public-key client certificate to the windows systems. Do I also have to define a server certificate, which holds the private key? Here's where I get a bit confused, because I've seen so many variants: I've seen the Extended keyUsage field set to both clientAuth and serverAuth; to just clientAuth; or to just serverAuth.
My assumption is that the client in trying to establish a VPN/IKEv2 session with the server, should be "authorized" by the server if the client sends the "correct" public key. So should I set the EKU on the server cert to clientAuth? or serverAuth? or both? (which doesn't make any sense to me)