So as I mentioned, Always On VPN relies on certificates issued by an
internal private enterprise PKI for a variety of things.
The first of those services is the VPN server itself. So let's talk
about the requirements for the VPN server's certificate template
that we'll create in Active Directory.
The certificate template used for the VPN server certificate is
a machine certificate that's issued to the VPN servers, and it
requires two very specific Enhanced Key Usage, or EKUs, to be
defined on that template.
It is the Server Authentication EKU and the IP Security IKE
Intermediate EKU. Many administrators overlook this second and rather
crucial EKU because technically speaking, server authentication's all
that's required for it to function.
However,
Windows Server relies on the IP Security IKE Intermediate EKU to
distinguish between multiple certificates that have server authentication
to use specifically for IPsec with IKEv2, so it's vital that we ensure
that this certificate has both EKUs included.
And finally, and this is equally important,
the subject name for this certificate must be supplied in the
request, and the reason for that is that the subject of the VPN
server's certificate is not the server's hostname, or its NetBIOS
name, rather it is the server's public name,
it is the name that you will put in public DNS that your
VPN clients will use to connect to it, and that is most
commonly not the VPN server name.
The VPN server might have a name like VPN1, and you might also
have multiple servers, VPN2, VPN3, and VPN4,
for example.
However,
you would probably address this entire cluster as vpn.example.com externally.
That is the name that will be used as the subject
for this particular certificate. So let's create this VPN server certificate template now.