<div><font color="#000099">Hi Andreas,</font></div>
<div><font color="#000099"></font> </div>
<div><font color="#000099">Thanks a lot for your reply. Please find my replies inline.<br><br></font></div>
<div class="gmail_quote">On Thu, Mar 17, 2011 at 10:08 PM, Andreas Steffen <span dir="ltr"><<a href="mailto:andreas.steffen@strongswan.org">andreas.steffen@strongswan.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">
<div class="im">On 17.03.2011 12:33, Meera Sudhakar wrote:<br>> Hi Andreas,<br>><br>> This problem was solved by the solution provided in<br>> <a href="http://www.mail-archive.com/users@lists.strongswan.org/msg02152.html" target="_blank">http://www.mail-archive.com/users@lists.strongswan.org/msg02152.html</a>. I<br>
> now have a new problem for which I cannot find a solution. It would be<br>> great if you could help me understand the problem, and hopefully provide<br>> a solution too.<br>><br>> I generated the private key and certificate for my machines (the<br>
> initiator and the receiver) by executing the following command on each<br>> of them:<br>><br>> openssl req -x509 -days 1460 -newkey rsa:2048 \<br>>> -keyout strongswanKey.pem -out strongswanCert.pem<br>
><br></div>This generates a self-signed CA certificate which cannot be used<br>as a peer certificate.<br>
<div class="im"><br>> I then placed the file strongswanKey.pem in the path<br>> /etc/ipsec.d/private/, and the file strongswanCert.pem in the path<br>> /etc/ipsec.d/certs. So now, the line " : RSA strongswanKey.pem "xxxx" "<br>
> is added to the file ipsec.secrets, and the line<br>> "leftcert=strongswanCert.pem" is added to the file ipsec.conf.<br>><br>> After starting strongswan, the following was seen in the log file:<br>
><br>> Mar 17 18:35:32 cip-Latitude-D520 charon: 00[CFG] loading secrets from<br>> '/etc/ipsec.secrets'<br>> Mar 17 18:35:32 cip-Latitude-D520 charon: 00[CFG] loaded RSA private<br>> key from '/etc/ipsec.d/private/strongswanKey.pem'<br>
> *Mar 17 18:35:32 cip-Latitude-D520 charon: 00[CFG] expanding file<br>> expression '/var/lib/strongswan/ipsec.secrets.inc' failed<br><br></div>do you include secrets from /var/lib/strongswan/ipsec.secrets.inc ?<br>
</blockquote>
<div> </div>
<div><font color="#000099">The line "include /var/lib/strongswan/ipsec.secrets.inc" was present in ipsec.conf. That file contains nothing though. So I now tried removing the line from ipsec.conf, but I still see the above message in the logfile. </font></div>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid"><br>> *Mar 17 18:35:32 cip-Latitude-D520 charon: 00[DMN] loaded plugins: curl<br>
<div class="im">> ldap aes des sha1 sha2 md5 random x509 pubkey pkcs1 pgp dnskey pem<br>> openssl fips-prf xcbc hmac agent gmp attr kernel-netlink socket-default<br>> farp stroke updown eap-identity eap-aka eap-md5 eap-gtc eap-mschapv2<br>
> dhcp resolve<br>><br>> Later on in the logs, I see that CHILD_SA was established, but IKE<br>> authentication failed. I am not sure if this is connected to the above<br>> problem. Please find a part of the logfile here:<br>
><br>> *Mar 17 18:35:44 cip-Latitude-D520 charon: 12[IKE] establishing CHILD_SA<br>> sample-with-ca-cert<br><br></div>This is just an announcement that a CHILD_SA is going to be established.<br></blockquote>
<div> </div>
<div><font color="#000099">Ok. </font></div>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid"><br>> *Mar 17 18:35:44 cip-Latitude-D520 charon: 12[ENC] generating IKE_AUTH<br>
<div class="im">> request 1 [ IDi CERT CERTREQ IDr AUTH SA TSi TSr N(MOBIKE_SUP)<br>> N(NO_ADD_ADDR) N(MULT_AUTH) N(EAP_ONLY) ]<br>> Mar 17 18:35:44 cip-Latitude-D520 charon: 12[NET] sending packet: from<br>> 10.58.114.215[4500] to 10.58.112.139[4500]<br>
> Mar 17 18:35:44 cip-Latitude-D520 charon: 13[NET] received packet: from<br>> 10.58.112.139[4500] to 10.58.114.215[4500]<br>> Mar 17 18:35:44 cip-Latitude-D520 charon: 13[ENC] parsed IKE_AUTH<br>> response 1 [ N(AUTH_FAILED) ]<br>
> *Mar 17 18:35:44 cip-Latitude-D520 charon: 13[IKE] received<br>> AUTHENTICATION_FAILED notify error<br></div>> *<br>The peer side has an authentication problem because you are sending<br>a self-signed certificate. You must send an end entity certificate<br>
signed by the strongSwan CA and put strongswanCert.pem into<br>/etc/ipsec.d/cacerts as a trust anchor.<br></blockquote>
<div> </div>
<div><font color="#000099">Ok. This was something I hadn't realized.</font></div>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">
<div class="im">><br>> Could you please help me sort this out?<br>><br></div>Consult the following link how to set up a simple PKI:<br><br><a href="http://wiki.strongswan.org/projects/strongswan/wiki/SimpleCA" target="_blank">http://wiki.strongswan.org/projects/strongswan/wiki/SimpleCA</a><br>
</blockquote>
<div> </div>
<div><font color="#000099">I went through the intructions in the link mentioned here. It's mentioned in the link that it was kept "as simple as possible", but I still have a couple of doubts here :-)</font></div>
<div> </div>
<div><font color="#000099">1. I have an initiator and a responder. So, I will first create a private key and self-signed CA certificate. This self-signed certificate will help me generate end-entity certificates. (I hope my understanding is right). I created these on the initiator first.</font></div>
<div><font color="#000099">2. I then created the peer key and end-entity certificate for the initiator, using the CA private key and CA certificate created in step 1.</font></div>
<div><font color="#000099">3. Now, I copied the CA private key and the CA certificate (created in step 1) to the responder, and there, I created the peer key and end-entity certificate for the responder. </font></div>
<div><font color="#000099">4. In each of the machines, I stored the peer key in /etc/ipsec.d/private, and the end-entity certificate in /etc/ipsec.d/certs. The CA cert is stored in /etc/ipsec.d/cacerts.</font></div>
<div><font color="#000099">5. I hope whatever I have done is correct. Please let me know if I understood the instructions correctly. Once I did this and started strongswan, I got the following messages in the logfile:</font></div>
<div><font color="#000099"></font> </div>
<div><font color="#000099">Mar 18 19:14:33 cip-Latitude-D520 charon: 12[ENC] parsed IKE_AUTH request 1 [ IDi CERT CERTREQ IDr AUTH SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(MULT_AUTH) N(EAP_ONLY) ]<br>Mar 18 19:14:33 cip-Latitude-D520 charon: 12[IKE] received cert request for "C=CH, O=strongSwan, CN=strongSwan CA"<br>
Mar 18 19:14:33 cip-Latitude-D520 charon: 12[IKE] received end entity cert "C=CH, O=strongSwan, CN=peer"<br>Mar 18 19:14:33 cip-Latitude-D520 charon: 12[CFG] looking for peer configs matching 10.58.114.215[C=CH, O=strongSwan, CN=peer]...10.58.112.139[C=CH, O=strongSwan, CN=peer]<br>
Mar 18 19:14:33 cip-Latitude-D520 charon: 12[CFG] selected peer config 'sample-with-ca-cert'<br>Mar 18 19:14:33 cip-Latitude-D520 charon: 12[CFG] using trusted ca certificate "C=CH, O=strongSwan, CN=strongSwan CA"<br>
Mar 18 19:14:33 cip-Latitude-D520 charon: 12[CFG] checking certificate status of "C=CH, O=strongSwan, CN=peer"<br>Mar 18 19:14:33 cip-Latitude-D520 charon: 12[CFG] certificate status is not available<br>Mar 18 19:14:33 cip-Latitude-D520 charon: 12[CFG] reached self-signed root ca with a path length of 0<br>
Mar 18 19:14:33 cip-Latitude-D520 charon: 12[CFG] using trusted certificate "C=CH, O=strongSwan, CN=peer"<br>Mar 18 19:14:33 cip-Latitude-D520 charon: 12[IKE] signature validation failed, looking for another key<br>
Mar 18 19:14:33 cip-Latitude-D520 charon: 12[CFG] using certificate "C=CH, O=strongSwan, CN=peer"<br>Mar 18 19:14:33 cip-Latitude-D520 charon: 12[CFG] using trusted ca certificate "C=CH, O=strongSwan, CN=strongSwan CA"<br>
Mar 18 19:14:33 cip-Latitude-D520 charon: 12[CFG] checking certificate status of "C=CH, O=strongSwan, CN=peer"<br>Mar 18 19:14:33 cip-Latitude-D520 charon: 12[CFG] certificate status is not available<br>Mar 18 19:14:33 cip-Latitude-D520 charon: 12[CFG] reached self-signed root ca with a path length of 0<br>
Mar 18 19:14:33 cip-Latitude-D520 charon: 12[IKE] authentication of 'C=CH, O=strongSwan, CN=peer' with RSA signature successful<br>Mar 18 19:14:33 cip-Latitude-D520 charon: 12[CFG] constraint check failed: peer not authenticated with peer cert 'C=CH, O=strongSwan, CN=peer'.<br>
Mar 18 19:14:33 cip-Latitude-D520 charon: 12[CFG] selected peer config 'sample-with-ca-cert' inacceptable<br>Mar 18 19:14:33 cip-Latitude-D520 charon: 12[CFG] no alternative config found<br></font></div>
<div><font color="#000099">I really feel I have done something wrong :-(</font></div>
<div><font color="#000099"> </font></div>
<div><font color="#000099">Also, I read in the link </font><a href="http://wiki.strongswan.org/issues/103"><font color="#000099">http://wiki.strongswan.org/issues/103</font></a><font color="#000099"> that "If authentication is based on X.509 certificates then the identity of the peer <strong>must always</strong> be contained in the peer certificate". This is something I did not do. I just copied the commands from the link you had mentioned. So, should I mention the peer's IP address while creating its certificate (in the dn)?</font></div>
<div><font color="#000099"></font> </div>
<div><font color="#000099">Thanks and regards,</font></div>
<div><font color="#000099">Meera </font></div>
<div> </div>
<div> </div>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid"><br>> Thanks in advance,<br>><br>> Meera<br><br>Regards<br><font color="#888888"><br>Andreas<br></font>
<div>
<div></div>
<div class="h5"><br>======================================================================<br>Andreas Steffen <a href="mailto:andreas.steffen@strongswan.org">andreas.steffen@strongswan.org</a><br>
strongSwan - the Linux VPN Solution! <a href="http://www.strongswan.org/" target="_blank">www.strongswan.org</a><br>Institute for Internet Technologies and Applications<br>University of Applied Sciences Rapperswil<br>
CH-8640 Rapperswil (Switzerland)<br>===========================================================[ITA-HSR]==<br></div></div></blockquote></div><br>