NordVPN IKEv2 certificate

Getting the NordVPN IKEv2 certificate

Where to download the certificate

• The certificate is provided by NordVPN for manual IKEv2/IPSec setups.
• You’ll usually download a file named something like root.der or NordVPN Root CA from NordVPN’s support articles.
• It’s best to download directly from NordVPN’s official support pages to ensure you get the correct certificate and any needed intermediate certificates.

What you’ll do with the certificate

• Install or import the root certificate on your device as part of the VPN profile.
• In many cases you’ll be asked to import the certificate in a certificate store or to trust the CA for IKEv2/IPSec.
• Some platforms require confirming that you want to trust the certificate for VPN connections.

How to install the NordVPN IKEv2 certificate on common devices

Android

• Open the downloaded root.der file or certificate file.
• Tap to install. You may be asked to enter your device password.
• When prompted, select the CA file and import the certificate.
• After installation, configure your IKEv2/IPSec profile to use NordVPN’s servers.

IOS (iPhone and iPad)

• Download the NordVPN IKEv2 certificate from the NordVPN support article.
• Open Settings > Profile Downloaded (or General > Profiles & Device Management).
• Tap NordVPN Root CA, then Install.
• Complete any prompts to trust the certificate for VPN connections.
• Create or import your IKEv2/IPSec profile using the certificate.

MacOS

• Download the NordVPN IKEv2 certificate to your Mac.
• Open the certificate in Finder (Downloads folder) and you’ll be prompted to Add or Install Certificate.
• Choose the Login keychain (or Local Machine if required) and complete the installer steps.
• Ensure the certificate is trusted for VPN connections in Keychain Access if needed.

Windows

• Download the NordVPN certificate, then open it to begin the installation.
• Choose Local Computer as the store and place certificates in the proper location (often “Trusted Root Certification Authorities”).
• Complete the wizard and then set up your IKEv2/IPSec connection in Windows’ VPN settings, selecting NordVPN as the server and using the certificate authentication.

Linux

• Download the root certificate and place it in the system’s CA store (the exact path depends on your distro).
• Update the CA store with commands like update-ca-certificates or update-ca-certificates-nss.
• When configuring an IKEv2 connection (e.g., strongSwan), point to the certificate as the CA for EAP or server authentication and complete your ipsec.conf/ipsec.secrets accordingly.

Important notes about certificates and trust

Intermediate certificates

• Some NordVPN IKEv2 configurations may require intermediate certificates in addition to the root certificate.
• If you encounter trust or authentication errors, ensure you have all necessary certificate chain pieces provided by NordVPN.
• In some cases, the server may send intermediate certificates during the IKEv2 handshake. Locally stored certificates should still be compatible when the chain is complete.

Common certificate issues

• Certificate not trusted: Make sure the CA (root) certificate is correctly installed and the correct certificate store is used for your device.
• Mismatched server certificate: If you manually specify a server, ensure you’re using a server endpoint that matches the certificate you installed.
• Missing intermediate certs: If you see errors about missing intermediate certificates, download and install any required intermediates from NordVPN’s guidance or support articles.

Quick comparison: manual IKEv2/IPsec setup across platforms

Troubleshooting steps if the certificate isn’t working

• Verify you downloaded the correct NordVPN IKEv2 root certificate from the official support page.
• Ensure you installed the certificate into the correct store or keychain for your OS.
• Check for intermediate certificates that may be required for the server you’re connecting to.
• Confirm the VPN profile uses IKEv2/IPSec with certificate authentication (not username/password only).
• Test with a different NordVPN server. Some servers might present certificate chains differently.

Best practices for using NordVPN IKEv2 with certificates

• Use the official NordVPN certificate file provided for IKEv2/IPSec configurations to minimize trust issues.
• Keep your certificate files unmodified and store them in a secure location on your device.
• When possible, rely on automatic certificate handling through the VPN client or system VPN manager, but know how to manually install if needed.
• Document the server you’re connecting to and the certificate file you installed, so future troubleshooting is faster.
• Regularly review NordVPN’s support articles for any changes to the certificate or recommended server lists.

The recommendation

For most users, the simplest path is to use NordVPN’s official IKEv2/IPSec setup guides for your device. Download the provided NordVPN IKEv2 certificate from the supported articles, install it according to your platform’s instructions, and configure your IKEv2/IPSec connection with the appropriate server. If you encounter certificate-related issues, re-check that you have all necessary chain certificates and that you’re using the right certificate for the specific server you’re connecting to. If you’re unsure, reach out to NordVPN support for guidance on the exact certificate chain required for your setup and server selection. Creating proxy or open VPN in mikrotik