slawek/simple-ca
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: Add DNS server support for VPN configuration in mobileconfig generation

Browse Source
This commit is contained in:
Sławek Koszewski
2026-05-25 09:16:39 +02:00
parent c537ae5dd7
commit 27461a0fbe
2 changed files with 12 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+5 -8
View File
@@ -174,7 +174,7 @@ Generates Apple `.mobileconfig` profiles for distributing CA certificates and op
|---|---|
| `--ca-cert` only | CA trust anchor |
| `--ca-cert` + `--client-cert` + `--client-key` | CA trust anchor + PKCS#12 client certificate |
| All of the above + `--remote-address` + `--match-domains` | CA + client cert + IKEv2 VPN |
| All of the above + `--remote-address` + `--dns` + `--match-domains` | CA + client cert + IKEv2 VPN |
### Usage
@@ -182,10 +182,9 @@ Generates Apple `.mobileconfig` profiles for distributing CA certificates and op
generate-mobileconfig.py --ca-cert CA.pem --output profile.mobileconfig \
--identifier com.example.vpn \
[--client-cert CLIENT.pem --client-key CLIENT_KEY.pem] \
[--remote-address vpn.example.com --match-domains example.com] \
[--remote-address vpn.example.com --dns 10.0.0.1 --match-domains example.com] \
[--profile-name "My VPN"] [--ca-name "My CA"] \
[--client-name "My Cert"] [--vpn-name "My VPN Connection"] \
[--openssl /usr/bin/openssl]
[--client-name "My Cert"] [--vpn-name "My VPN Connection"]
```
#### Required arguments
@@ -202,6 +201,7 @@ generate-mobileconfig.py --ca-cert CA.pem --output profile.mobileconfig \
#### VPN (requires client certificate)
- `--remote-address FQDN` — VPN gateway hostname.
- `--dns IP [IP …]` — DNS server(s) for split DNS.
- `--match-domains DOMAIN [DOMAIN …]` — Split-DNS domains routed through the VPN.
#### Display name overrides (all optional)
@@ -211,10 +211,6 @@ generate-mobileconfig.py --ca-cert CA.pem --output profile.mobileconfig \
- `--client-name NAME` — Client cert payload display name (default: certificate CN).
- `--vpn-name NAME` — VPN connection display name (default: profile name).
#### Other
- `--openssl PATH` — Path to the `openssl` binary (default: `/usr/bin/openssl`).
### Examples
**CA trust profile only:**
@@ -245,6 +241,7 @@ python3 generate-mobileconfig.py \
--client-cert certs/alice_cert.pem \
--client-key certs/alice_key.pem \
--remote-address vpn.example.com \
--dns 10.0.0.1 \
--match-domains example.com internal.example.com \
--output alice-vpn.mobileconfig
```