<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Hello Devs,</p>
<p>Can anyone shed some light on my problem?<br>
</p>
I have 2 StrongSwan VPN gateways both running very similar software
and very similar configuration. (I've tried 5.0.1 and 5.5.0)<br>
<br>
One GW includes a CERTREQ in the SA_INIT response whilst the other
one does not. <br>
If the GW includes the CERTREQ then the client provides the CERT in
the subsequent AUTH and the client is successfully authenticated. <br>
If th GW does not include the CERTREQ then the client does *not*
provide the CERT and the authentication fails with the error: "no
trusted RSA public key found "<br>
<br>
Not Working: <br>
<tt>parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP)
N(NATD_D_IP) N((16430)) N((16431)) N(REDIR_SUP) ]</tt><br>
<tt>generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP)
N(NATD_D_IP) N(HASH_ALG) N(MULT_AUTH) ]</tt><br>
<tt>parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) CERTREQ
AUTH CP(ADDR ADDR6 DNS DNS6) N(ESP_TFC_PAD_N) SA TSi TSr
N(MOBIKE_SUP) N(NO_ADD_ADDR) N(MULT_AUTH) N(EAP_ONLY)
N(MSG_ID_SYN_SUP) ]<br>
<br>
</tt>Working: <br>
<tt>parsed </tt><tt>IKE_SA_INIT request 0 [ SA KE No
N(NATD_S_IP) N(NATD_D_IP) N((16430)) N((16431)) N(REDIR_SUP) ]</tt><tt><br>
</tt><tt>generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP)
N(NATD_D_IP) <b>CERTREQ </b>N(MULT_AUTH) ]<br>
parsed IKE_AUTH request 1 [ IDi <b>CERT </b>N(INIT_CONTACT)
CERTREQ AUTH CP(ADDR ADDR6 DNS DNS6) N(ESP_TFC_PAD_N) SA TSi TSr
N(MOBIKE_SUP) N(NO_ADD_ADDR) N(MULT_AUTH) N(EAP_ONLY)
N(MSG_ID_SYN_SUP) ]<br>
<br>
Any ideas what tiggers the GW to include the CERTREQ? I've been
playing with the sendcert attributes but it doesn't seem to help.<br>
<br>
Many thanks for reading<br>
<br>
Alan.<br>
</tt>
<div id="DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2"><br />
<table style="border-top: 1px solid #D3D4DE;">
<tr>
<td style="width: 55px; padding-top: 13px;"><a href="https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient" target="_blank"><img src="https://ipmcdn.avast.com/images/icons/icon-envelope-tick-round-orange-animated-no-repeat-v1.gif" alt="" width="46" height="29" style="width: 46px; height: 29px;" /></a></td>
<td style="width: 470px; padding-top: 12px; color: #41424e; font-size: 13px; font-family: Arial, Helvetica, sans-serif; line-height: 18px;">Virus-free. <a href="https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient" target="_blank" style="color: #4453ea;">www.avast.com</a>
</td>
</tr>
</table><a href="#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2" width="1" height="1"> </a></div></body>
</html>