In short: Remote ID is a field in manual IKEv2/IPsec VPN settings where you enter the VPN server name — usually its fully qualified domain name (FQDN). Your device compares this name against the server's certificate to confirm it is connecting to the correct server, not an impostor. The value comes from your provider's setup guide; in most cases it matches the server address.
What is Remote ID in a VPN?
Remote ID is the VPN server identifier in the IKEv2 protocol that your device uses to verify the server's authenticity when establishing a connection. In RFC 7296 (the IKEv2 standard) it is called IDr — Identification-Responder, the identifier of the side that responds to a connection request (the server). You may also see it labelled Remote Identifier or "server identifier" in different interfaces.
How verification works: when establishing an IKEv2 connection, the server presents its digital certificate. Your device takes the value from the Remote ID field and checks whether it matches the name in the server's certificate (the Common Name or SubjectAltName field). If they match, the connection is established; if not, you get a "could not verify server certificate" error. This is how IKEv2 prevents man-in-the-middle attacks at the handshake stage.
Where does the Remote ID field appear?
The Remote ID field only appears when you configure a VPN manually as an IKEv2/IPsec type using the operating system's built-in client. If you connect through a dedicated VPN app or import a ready-made configuration profile, the field is filled in automatically — no manual entry needed.
Most users encounter this field when doing manual VPN setup on iPhone without an app: the IKEv2 system client asks for three parameters at once — Server, Remote ID, and Local ID.
On iPhone and iPad
Path: Settings → VPN → Add VPN Configuration → IKEv2 type. The form shows fields for Description (a profile name), Server (network address), Remote ID (for certificate verification), and Local ID (your client identifier). All values are provided by your VPN provider in the manual setup guide. For a step-by-step walkthrough, see how to set up a VPN on iPhone.
On Android and macOS
On Android 12+, the built-in IKEv2 client is at Settings → Network and internet → VPN → «+». An equivalent Remote ID field appears there. On older Android versions, strongSwan was used and also prompts for this value. On macOS: System Settings → VPN → Add VPN Configuration. If your provider gave you a ready-made profile, the Remote ID, Server, and Local ID fields are filled in for you automatically.
Remote ID, Local ID, and Server: what is the difference?
When configuring IKEv2 manually, three fields sit side by side and are easy to confuse:
| Field | What it is | What to enter |
|---|---|---|
| Server | Network address — the device uses this to physically reach the server on the internet | Domain or IP of the VPN server (e.g. vpn.example.com) |
| Remote ID | Server name for digital certificate verification — confirms the server's authenticity | Domain name (FQDN), usually matches the server address |
| Local ID | Your client identifier — the server uses it during your authentication | Username, email, or name from provider data; sometimes left blank |
Server and Remote ID often hold the same value, but they serve different roles. Server is the network address for the IP connection; Remote ID is the name verified against the certificate — a cryptographic authentication mechanism. They can differ, for example, when the server is reachable by IP but the certificate registers a domain name.
What to enter in the Remote ID field?
Enter whatever value your VPN provider specifies in the IKEv2 manual setup guide. In most configurations this is the server's domain name (FQDN) — the same as the Server field. For example, if the server address is us1.example-vpn.com, enter that same value in Remote ID: this is the name the server has registered in its certificate under Common Name (CN) or SubjectAltName (SAN).
Do not try to guess the value: one wrong character or wrong subdomain triggers a certificate error. Copy the exact value from the provider's setup email or account dashboard. If the provider did not list Remote ID separately, it most likely matches the server address.
Why Remote ID matters: server certificate verification
Remote ID protects you from connecting to a fraudulent server. Without this verification, an attacker could run their own IKEv2 server and intercept your traffic — a classic man-in-the-middle attack at the cryptographic handshake stage.
How it works: during the IKEv2 handshake, the server presents a digital certificate issued by a trusted certificate authority (CA). The device takes the Remote ID value and compares it with the Common Name (CN) or SubjectAltName (SAN) in the certificate. According to RFC 7296, this corresponds to the IDr payload — Identification-Responder — which the server signs with its private key during IKE_AUTH. A match confirms authenticity, and only then is the encrypted tunnel established.
WireGuard and OpenVPN accomplish the same goal without a separate Remote ID field. For a comparison of all three protocols, see VPN protocols: WireGuard, OpenVPN, and IKEv2.
"Could not verify server certificate" error: causes and fixes
This error means the Remote ID value did not match what is in the server's certificate. Common causes and fixes:
- Typo or extra space. The most frequent cause. Copy the value directly from the provider's guide without retyping it.
- IP address instead of domain. If the certificate uses a domain name and you entered an IP, verification fails. Ask your provider which value appears in the certificate.
- Root CA certificate not installed. Some providers use a private certificate authority. Without its CA certificate on your device, the trust chain cannot be verified — install it following the provider's instructions.
- Wrong subdomain.
vpn.example.comandvpn1.example.comare different strings. Check the exact value from the provider's guide. - Wrong date or time on device. Certificates have validity periods; if your clock is off, the certificate is flagged as invalid. Enable automatic time synchronisation.
- Provider changed server domain. Old setup data no longer matches the new certificate. Get fresh details from the provider's current guide.
- Self-signed certificate without CA. It must be explicitly installed as trusted on your device, or reinstall the provider's ready-made profile.
Universal fix: get the exact parameters from the provider's current setup guide or reinstall their ready-made configuration profile — faster than hunting for a typo manually.
Why WireGuard and OpenVPN have no Remote ID field
Remote ID is specific to IKEv2/IPsec. WireGuard and OpenVPN verify server authenticity differently — no separate field with that name exists.
WireGuard identifies the server by its public key, hard-coded into the client configuration at setup. The cryptographic handshake fails if the keys do not match — the server identity is baked into the key system itself, so no separate Remote ID field is needed.
OpenVPN identifies the server via a certificate embedded in the .ovpn configuration file, together with the CA certificate for verification. Everything is in one file, and no Remote ID field is shown to the user.
IKEv2 was designed for flexible corporate infrastructure with diverse authentication methods and pre-existing CA deployments. As a result, the server identifier is an explicit separate parameter that must be passed to the client. This flexibility comes at the cost of an extra field during manual setup. For a detailed comparison of all three protocols, see WireGuard, OpenVPN, and IKEv2: which to choose.
Do you need to fill in Remote ID manually?
In most cases, no. VPN apps and ready-made configuration profiles fill in all fields automatically, including Remote ID. Manual entry is only needed when configuring through the OS IKEv2 client without a profile, or when deploying a corporate VPN from scratch.
LiMP VPN fills in all connection parameters automatically — just install the app, sign in, and tap Connect. No need to understand identifiers, FQDN, or certificate chains. More about features at LiMP VPN features; plans on the pricing page.
Frequently asked questions
What to enter in the Remote ID VPN field?
Enter the VPN server domain name provided by your provider. In most IKEv2 configurations it matches the server address — this is the name registered in the server's certificate under CN or SAN.
What is the difference between Remote ID and Local ID?
Remote ID is the server's name (who you are verifying). Local ID is your identifier as the client (who you are). Both are used in IKEv2 mutual authentication: Remote ID is matched against the server certificate, Local ID identifies you to the server.
Can Remote ID be left blank?
No, not for IKEv2 with certificate verification. Without Remote ID the device cannot confirm the server's identity and will throw a connection error.
Why does it say "could not verify server certificate"?
Usually because Remote ID does not match the certificate: a typo, an IP instead of a domain, a missing root CA certificate, or a wrong device clock. Get the exact value from your provider's current guide or reinstall their configuration profile.
Is Remote ID needed in WireGuard?
No. WireGuard verifies the server by its public key embedded in the configuration — there is no Remote ID field by design of the protocol.