Issue with x509 certificate (unsupported critical X.509 extension: 1.3.6.1.4.1.311.21.10)

Lordr

hi,

when trying to connect to pfsence ipkv2 server i receive the following errors:

OpenSSL X.509 parsing failed
found unsupported critical X.509 extension: 1.3.6.1.4.1.311.21.10
critical 'msApplicationCertPolicies' extension not supported

it basically means that linux does not like the microsoft certificates, which is ok as we have been working with it all using the following workaround (clientsided):

/etc/strongswan.d/libstrongswan-relax-constraints.conf

libstrongswan {
  x509 {
    enforce_critical = no
  }

But in pfsence log I see the same error messages, so I created /var/etc/ipsec/libstrongswan-relax-constraints.conf and added the afore mentioned content. I also set "enforce_critical = no" in /var/etc/ipsec/strongswan.d/charon.conf. but error remains the same.

any ideas ?

PS : Why is "locate" not working when connecting to pfsense in a terminal (command not found) ? In freebsd it should be installed by default

Lordr

that setting on server side is not necessary. once we setup the radius server correctly the X509 error messages were gone.