Azure VPN connection on Mac for macOS 13.4+

Have you followed the following guide?

https://learn.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-client-mac

What steps do you seem to get stuck on?

@Madhurima Nath

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you would like to use Azure P2S VPN with certificate authentication in Mac OS

Wrt, "There is no "client certificate" when the VPN client folder is downloaded"

• This is an expected behavior
• Only Root Certificate will be available with the configuration.
• You should manually install the Client Certificate which you generated to your MacOS devices.

I take it that you are using IKEV2 Protocol. If not, make sure this is selected.

1.Generate Server and Client certificates: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-certificates-point-to-site

• Export Server Certificate - this goes to Azure VPN Gateway P2S Configuration
• Export Client Certificate - this will not be a part of VPN Gateway.
  • You must manually install this to other computers from where you want to access the P2S VPN.

2.IKEv2: native VPN client - macOS : https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-vpn-client-cert-mac#ikev2-native-vpn-client---macos-steps

• The Generic folder will only contain VpnSettings.xml and VpnServerRoot.cer and not Client certificates.
• Install Root Certificate to the macOs : https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-vpn-client-cert-mac#root-certificate
• Install Client Certificate to the macOs : https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-how-to-vpn-client-install-azure-cert#installmac

Hope this helps.

Let us know should you require more information

Thanks,

Kapil

Thank you for the instructions.
I couldn't find any .pfx file as mentioned "Locate the .pfx certificate file and copy it to your Mac. You can get the certificate to the Mac in several ways. For example, you can email the certificate file."
Is there any specific source where this can be found?

@Madhurima Nath

It depends on how you are generating the VPN Certificates.

It's easier to do it in Windows with Powershell.

After creating the root certificate, with the Powershell terminal still open,

• Run

$params = @{
       Type = 'Custom'
       Subject = 'CN=P2SChildCert'
       DnsName = 'P2SChildCert'
       KeySpec = 'Signature'
       KeyExportPolicy = 'Exportable'
       KeyLength = 2048
       HashAlgorithm = 'sha256'
       NotAfter = (Get-Date).AddMonths(18)
       CertStoreLocation = 'Cert:\CurrentUser\My'
       TextExtension = @(
        '2.5.29.37={text}1.3.6.1.5.5.7.3.2')
   }
   New-SelfSignedCertificate @params

• This would generate the certificate and store it in 'Certificates - Current User\Personal\Certificates' on your computer.
• Then export it by navigating to "Certificates - Current User\Personal\Certificates"
  • 
• Check : https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-certificates-point-to-site#example-1---powershell-console-session-still-open

If you had generated the Root certificate and the Client certificate is not generated along with it,

You can refer this : https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-certificates-point-to-site#ex2

or

Create a new Root and Client certificate on the fly.

Cheers,

Kapil

Cheers,

Kapil.