<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:p="urn:schemas-microsoft-com:office:powerpoint" xmlns:a="urn:schemas-microsoft-com:office:access" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:s="uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882" xmlns:rs="urn:schemas-microsoft-com:rowset" xmlns:z="#RowsetSchema" xmlns:b="urn:schemas-microsoft-com:office:publisher" xmlns:ss="urn:schemas-microsoft-com:office:spreadsheet" xmlns:c="urn:schemas-microsoft-com:office:component:spreadsheet" xmlns:odc="urn:schemas-microsoft-com:office:odc" xmlns:oa="urn:schemas-microsoft-com:office:activation" xmlns:html="http://www.w3.org/TR/REC-html40" xmlns:q="http://schemas.xmlsoap.org/soap/envelope/" xmlns:rtc="http://microsoft.com/officenet/conferencing" xmlns:D="DAV:" xmlns:Repl="http://schemas.microsoft.com/repl/" xmlns:mt="http://schemas.microsoft.com/sharepoint/soap/meetings/" xmlns:x2="http://schemas.microsoft.com/office/excel/2003/xml" xmlns:ppda="http://www.passport.com/NameSpace.xsd" xmlns:ois="http://schemas.microsoft.com/sharepoint/soap/ois/" xmlns:dir="http://schemas.microsoft.com/sharepoint/soap/directory/" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:dsp="http://schemas.microsoft.com/sharepoint/dsp" xmlns:udc="http://schemas.microsoft.com/data/udc" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:sub="http://schemas.microsoft.com/sharepoint/soap/2002/1/alerts/" xmlns:ec="http://www.w3.org/2001/04/xmlenc#" xmlns:sp="http://schemas.microsoft.com/sharepoint/" xmlns:sps="http://schemas.microsoft.com/sharepoint/soap/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:udcs="http://schemas.microsoft.com/data/udc/soap" xmlns:udcxf="http://schemas.microsoft.com/data/udc/xmlfile" xmlns:udcp2p="http://schemas.microsoft.com/data/udc/parttopart" xmlns:wf="http://schemas.microsoft.com/sharepoint/soap/workflow/" xmlns:dsss="http://schemas.microsoft.com/office/2006/digsig-setup" xmlns:dssi="http://schemas.microsoft.com/office/2006/digsig" xmlns:mdssi="http://schemas.openxmlformats.org/package/2006/digital-signature" xmlns:mver="http://schemas.openxmlformats.org/markup-compatibility/2006" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns:mrels="http://schemas.openxmlformats.org/package/2006/relationships" xmlns:spwp="http://microsoft.com/sharepoint/webpartpages" xmlns:ex12t="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:ex12m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:pptsl="http://schemas.microsoft.com/sharepoint/soap/SlideLibrary/" xmlns:spsl="http://microsoft.com/webservices/SharePointPortalServer/PublishedLinksService" xmlns:Z="urn:schemas-microsoft-com:" xmlns:st="" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoNoSpacing, li.MsoNoSpacing, div.MsoNoSpacing
{mso-style-priority:1;
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal>Hi All<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>I have started using strongswan 4.3.6 and just tried the
basic peer to peer setup using two linux machines. I am unable to get the
connection up and it always displays a private key not found error for DN
name. I have browsed through several related posts in this list but some how
could not find the solution to it. So I really apologize if this is a
duplicate post .<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>I have two linux machines 211 (Ip Address 10.201.114.211) &
178 ( IP address 10.201.114.178)<o:p></o:p></p>
<p class=MsoNormal>Between which I am trying to create the ipsec connection.<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Here is the debugging data for both the machines<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal><span style='font-size:20.0pt'>211<o:p></o:p></span></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Ipsec.conf<o:p></o:p></p>
<p class=MsoNormal>-----------------------------------------------------------------------------------------------<o:p></o:p></p>
<p class=MsoNormal># ipsec.conf - strongSwan IPsec configuration file<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal># basic configuration<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>config setup<o:p></o:p></p>
<p class=MsoNormal> crlcheckinterval=180<o:p></o:p></p>
<p class=MsoNormal> strictcrlpolicy=no<o:p></o:p></p>
<p class=MsoNormal> plutostart=no<o:p></o:p></p>
<p class=MsoNormal> charondebug="ike 4, knl 4, cfg 4"<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal># Add connections here.<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal># Sample VPN connections<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>conn 211TO178Tunnel<o:p></o:p></p>
<p class=MsoNormal> left=10.201.114.211<o:p></o:p></p>
<p class=MsoNormal> leftcert=211Cert.pem<o:p></o:p></p>
<p class=MsoNormal> right=10.201.114.178<o:p></o:p></p>
<p class=MsoNormal> #rightid="C=IN, O=WT, CN=10.201.114.178"<o:p></o:p></p>
<p class=MsoNormal> keyexchange=ikev2<o:p></o:p></p>
<p class=MsoNormal> #type=tunnel<o:p></o:p></p>
<p class=MsoNormal> auto=add<o:p></o:p></p>
<p class=MsoNormal> <o:p></o:p></p>
<p class=MsoNormal>ipsec.secrets<o:p></o:p></p>
<p class=MsoNormal>--------------------------------------------------------------------------------------------<o:p></o:p></p>
<p class=MsoNormal>: RSA 211Key.pem "2111"<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>ipsec up 211TO178Tunnel<o:p></o:p></p>
<p class=MsoNormal>-----------------------------------------------------------------------------------------------<o:p></o:p></p>
<p class=MsoNormal>initiating IKE_SA 211TO178Tunnel[1] to 10.201.114.178<o:p></o:p></p>
<p class=MsoNormal>generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP)
N(NATD_D_IP) ]<o:p></o:p></p>
<p class=MsoNormal>sending packet: from 10.201.114.211[500] to
10.201.114.178[500]<o:p></o:p></p>
<p class=MsoNormal>received packet: from 10.201.114.178[500] to
10.201.114.211[500]<o:p></o:p></p>
<p class=MsoNormal>parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP)
N(NATD_D_IP) CERTREQ N(MULT_AUTH) ]<o:p></o:p></p>
<p class=MsoNormal>received cert request for "C=IN, ST=KAR, L=EC, O=WT,
OU=TEV, CN=10.201.114.211, E=info@wt.com"<o:p></o:p></p>
<p class=MsoNormal>sending cert request for "C=IN, ST=KAR, L=EC, O=WT,
OU=TEV, CN=10.201.114.211, E=info@wt.com"<o:p></o:p></p>
<p class=MsoNoSpacing>no private key found for 'C=IN, ST=KAR, O=WT, OU=TEV,
CN=10.201.114.211, E=info@s2-wt.com'<o:p></o:p></p>
<p class=MsoNormal> <o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<div style='mso-element:para-border-div;border:none;border-bottom:solid windowtext 1.0pt;
padding:0in 0in 1.0pt 0in'>
<p class=MsoNormal style='border:none;padding:0in'>When I do a ipsec start I get
the following log in syslog at the end<o:p></o:p></p>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>getting interface name for 10.201.114.178 <o:p></o:p></p>
<p class=MsoNormal>Apr 20 02:31:11 localhost charon: 14[KNL] 10.201.114.178 is
not a local address <o:p></o:p></p>
<p class=MsoNormal>Apr 20 02:31:11 localhost charon: 14[KNL] getting interface
name for 10.201.114.211 <o:p></o:p></p>
<p class=MsoNormal>Apr 20 02:31:11 localhost charon: 14[KNL] 10.201.114.211 is
on interface eth0 <o:p></o:p></p>
<p class=MsoNormal>Apr 20 02:31:11 localhost charon: 14[CFG] loaded
certificate "C=IN, ST=KAR, O=WT, OU=TEV, CN=211, E=info@s2-wt.com"
from '211Cert.pem' <o:p></o:p></p>
<p class=MsoNormal>Apr 20 02:31:11 localhost charon: 14[CFG] id
'10.201.114.211' not confirmed by certificate, defaulting to 'C=IN, ST=KAR,
O=WT, OU=TEV, CN=211, E=info@s2-wt.com' <o:p></o:p></p>
<p class=MsoNormal>Apr 20 02:31:11 localhost charon: 14[CFG] added
configuration '211TO178Tunnel'<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>I feel that the message : id '10.201.114.211' not
confirmed by certificate, defaulting to 'C=IN, ST=KAR, O=WT, OU=TEV, CN=211, <a
href="mailto:E=info@s2-wt.com">E=info@s2-wt.com</a>' could be the culprit but
unable to figure out the reason.<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<div style='mso-element:para-border-div;border:none;border-bottom:solid windowtext 1.0pt;
padding:0in 0in 1.0pt 0in'>
<p class=MsoNormal style='border:none;padding:0in'>ipsec listcerts<o:p></o:p></p>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>List of X.509 End Entity Certificates:<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal> subject: "C=IN, ST=KAR, O=WT, OU=TEV,
CN=10.201.114.211, E=info@s2-wt.com"<o:p></o:p></p>
<p class=MsoNormal> issuer: "C=IN, ST=KAR, L=EC, O=WT, OU=TEV,
CN=10.201.114.211, E=info@wt.com"<o:p></o:p></p>
<p class=MsoNormal> serial: 01:22<o:p></o:p></p>
<p class=MsoNormal> validity: not before Apr 20 00:35:20 2010, ok<o:p></o:p></p>
<p class=MsoNormal> not after Apr 19 00:35:20 2012, ok <o:p></o:p></p>
<p class=MsoNormal> pubkey: RSA 1024 bits<o:p></o:p></p>
<p class=MsoNormal> keyid: de:70:04:d4:76:ef:23:10:b2:98:88:20:d3:ab:78:8c:54:4c:3b:54<o:p></o:p></p>
<p class=MsoNormal> subjkey:
34:b8:59:19:d5:2a:a9:f9:48:76:ff:8d:f1:79:ab:3f:71:d6:4b:86<o:p></o:p></p>
<p class=MsoNormal> authkey:
09:57:1b:cc:fa:28:3d:fe:0e:ac:fb:97:fe:89:6f:53:9d:4b:8f:0d<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal><span style='font-size:20.0pt'>178<o:p></o:p></span></p>
<p class=MsoNormal><o:p> </o:p></p>
<div style='mso-element:para-border-div;border:none;border-bottom:solid windowtext 1.0pt;
padding:0in 0in 1.0pt 0in'>
<p class=MsoNormal style='border:none;padding:0in'>Ipsec.conf<o:p></o:p></p>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal># ipsec.conf - strongSwan IPsec configuration file<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal># basic configuration<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>config setup<o:p></o:p></p>
<p class=MsoNormal> crlcheckinterval=600<o:p></o:p></p>
<p class=MsoNormal> strictcrlpolicy=no<o:p></o:p></p>
<p class=MsoNormal> charondebug="ike 4, knl 4, cfg 4"<o:p></o:p></p>
<p class=MsoNormal> plutostart=no<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal># Add connections here.<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal># Sample VPN connections<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>conn 211TO178Tunnel<o:p></o:p></p>
<p class=MsoNormal> right=10.201.114.211<o:p></o:p></p>
<p class=MsoNormal> left=10.201.114.178<o:p></o:p></p>
<p class=MsoNormal> leftcert=178Cert.pem<o:p></o:p></p>
<p class=MsoNormal> #rightid="C=IN, O=WT, CN=10.201.114.211"<o:p></o:p></p>
<p class=MsoNormal> keyexchange=ikev2<o:p></o:p></p>
<p class=MsoNormal> #type=tunnel<o:p></o:p></p>
<p class=MsoNormal> auto=add<o:p></o:p></p>
<p class=MsoNormal> <o:p></o:p></p>
<div style='mso-element:para-border-div;border:none;border-bottom:solid windowtext 1.0pt;
padding:0in 0in 1.0pt 0in'>
<p class=MsoNormal style='border:none;padding:0in'>ipsec.secrets<o:p></o:p></p>
</div>
<p class=MsoNormal># /etc/ipsec.secrets - strongSwan IPsec secrets file<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>: RSA 178Key.pem "1788"<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<div style='mso-element:para-border-div;border:none;border-bottom:solid windowtext 1.0pt;
padding:0in 0in 1.0pt 0in'>
<p class=MsoNormal style='border:none;padding:0in'>ipsec listcerts<o:p></o:p></p>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>List of X.509 End Entity Certificates:<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal> subject: "C=IN, ST=KAR, O=WT, OU=TEV, CN=178,
E=info@sjp-wt.com"<o:p></o:p></p>
<p class=MsoNormal> issuer: "C=IN, ST=KAR, L=EC, O=WT, OU=TEV,
CN=10.201.114.211, E=info@wt.com"<o:p></o:p></p>
<p class=MsoNormal> serial: 01:25<o:p></o:p></p>
<p class=MsoNormal> validity: not before Apr 20 02:13:03 2010, ok<o:p></o:p></p>
<p class=MsoNormal> not after Apr 19 02:13:03 2012, ok <o:p></o:p></p>
<p class=MsoNormal> pubkey: RSA 1024 bits<o:p></o:p></p>
<p class=MsoNormal> keyid:
5c:ff:4f:12:27:37:95:38:7f:3c:13:e6:c5:43:49:c4:0d:13:10:44<o:p></o:p></p>
<p class=MsoNormal> subjkey: 6a:de:d5:87:6f:d6:e5:61:e6:42:f7:84:1f:1c:35:e3:96:1a:92:96<o:p></o:p></p>
<p class=MsoNormal> authkey:
09:57:1b:cc:fa:28:3d:fe:0e:ac:fb:97:fe:89:6f:53:9d:4b:8f:0d<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>When I do a ipsec start in 178 I get the same not confirmed
by certificate message. <o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>I have verified and reverified and recreated the keys several
times with different CN values also but no success. <o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Regards</span><span
style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Shyam</span><o:p></o:p></p>
</div>
<P><strong><span style='font-size:10.0pt;font-family:
"Palatino Linotype","serif";color:green'> Please do not print this email unless it is absolutely necessary. </span></strong><span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
<p> The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. </p>
<p>WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. </p>
<p>
www.wipro.com
</p>
</body>
</html>