server-to-server IPSec with certificate authentication and without Active Directory

i trying secure communication between several computers in workgroup using "windows firewall advanced security" , "connection security rules". i'm doing server-to-server ipsec config.

the authentication fails error: "ike failed find valid machine certificate". 

i have valid wildcard certificate company's public domain issued external third party ca. cert in computer personal store. cert has:

   ku: digital signature, key encipherment, data encipherment (b0)

   eku: server authentication , client authentication

is reason failure fact cert issued domain servers not part of (it workgroup fqdn lacking domain part. played primarydnssufix, didn't work either)? reason fact cert not having eku "ip security ike intermediate"? there workaround? can "force" servers use particular cert? can implement above scenario @ (workgroup , wildcard cert)? struggle googling examples able find seems ad related..

thanks. 

hi inanevski,

i haven't tested using third-party certificate authenticate "server-to-server" ipsec.

when using adcs issued certificate, need meet following things:

1. certificate's eku has "ip security ike intermediate";

2. 2 endpoint store root certificate trust each other's certificate.

so, far i'm concerned, need check if certificate used 2 servers can trust each, certificate need have function authenticate ipsec connection.

best regards,

anne

---

please remember mark replies answers if help.
if have feedback technet subscriber support, contact tnmff@microsoft.com.

Windows Server  >  Security