Problem with IKEv2 Configuration IVPN

Hello,

I’ve been trying to configure IKEv2 on my OpenWRT router using StrongSwan, but I keep encountering an issue where the connection fails due to "no trusted RSA public key found" for the VPN server. Here is an overview of what I’ve done so far:

  1. System and Software:

  2. Certificates:

    • Downloaded and installed all the required certificates as per IVPN's guide:
      • isrgrootx1.pem
      • lets-encrypt-r3.pem
      • lets-encrypt-x3-cross-signed.pem
      • letsencryptauthorityx3.pem
    • Combined the certificates into one file and pointed rightca to that file in my configuration.
    • Verified the certificates using ipsec listcacerts, and they appear to be installed correctly.
  3. Configuration:
    Here’s the relevant section of my configuration file:

    conn ivpn
        keyexchange=ikev2
        keyingtries=%forever
        dpdaction=restart
        dpddelay=300s
        inactivity=36000s
        rekey=no
        forceencaps=yes
        authby=secret
        ike=aes256-sha256-modp2048
        esp=aes256-sha256
        leftfirewall=yes
        left=192.168.1.1
        leftsourceip=%config
        leftsendcert=always
        leftauth=eap-mschapv2
        rightfirewall=yes
        rightauth=pubkey
        right=se1.gw.ivpn.net
        rightid=se1.gw.ivpn.net
        rightsubnet=0.0.0.0/0
        rightsendcert=always
        eap_identity="i-XXXX-XXXX-XXXX"
        type=tunnel
        auto=add
    
  4. Issues:
    When attempting to establish the connection, I receive the following error message:

    no trusted RSA public key found for '80.67.10.138'
    

    Despite downloading and installing the certificates properly, the VPN server does not seem to trust the certificate or there is some other issue with the authentication process.

  5. Tried Solutions:

    • Tried adjusting the leftid and rightid to ensure they match the server’s identity.
    • Verified certificates and the chain, all seem correct.
    • Attempted to switch to swanctl as recommended, but the issue persists.