<html><body>
<p><font size="2" face="sans-serif">Hello,</font><br>
<br>
<font size="2" face="sans-serif">I'm trying to set up the TNC Client and Server configuration using EAP-TLS certificate based authentication. The main difference between my config and the one found in <a href="http://wiki.strongswan.org/projects/strongswan/wiki/TrustedNetworkConnect">http://wiki.strongswan.org/projects/strongswan/wiki/TrustedNetworkConnect</a> is that I'm using ECDSA certificates instead of RSA certificates. When I start up the client I get a handshake failure. And I see the following in charon.log</font><br>
<br>
<font size="2" face="sans-serif">May 4 15:47:31 04[TLS] processing TLS Handshake record (81 bytes)</font><br>
<font size="2" face="sans-serif">May 4 15:47:31 04[TLS] received TLS ClientHello handshake (77 bytes)</font><br>
<font size="2" face="sans-serif">May 4 15:47:31 04[TLS] received TLS 'signature algorithms' extension</font><br>
<font size="2" face="sans-serif">May 4 15:47:31 04[TLS] received 10 TLS cipher suites:</font><br>
<font size="2" face="sans-serif">May 4 15:47:31 04[TLS] TLS_DHE_RSA_WITH_AES_128_CBC_SHA</font><br>
<font size="2" face="sans-serif">May 4 15:47:31 04[TLS] TLS_DHE_RSA_WITH_AES_128_CBC_SHA256</font><br>
<font size="2" face="sans-serif">May 4 15:47:31 04[TLS] TLS_DHE_RSA_WITH_AES_256_CBC_SHA</font><br>
<font size="2" face="sans-serif">May 4 15:47:31 04[TLS] TLS_DHE_RSA_WITH_AES_256_CBC_SHA256</font><br>
<font size="2" face="sans-serif">May 4 15:47:31 04[TLS] TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA</font><br>
<font size="2" face="sans-serif">May 4 15:47:31 04[TLS] TLS_RSA_WITH_AES_128_CBC_SHA</font><br>
<font size="2" face="sans-serif">May 4 15:47:31 04[TLS] TLS_RSA_WITH_AES_128_CBC_SHA256 </font><br>
<font size="2" face="sans-serif">May 4 15:47:31 04[TLS] TLS_RSA_WITH_AES_256_CBC_SHA</font><br>
<font size="2" face="sans-serif">May 4 15:47:31 04[TLS] TLS_RSA_WITH_AES_256_CBC_SHA256</font><br>
<font size="2" face="sans-serif">May 4 15:47:31 04[TLS] TLS_RSA_WITH_3DES_EDE_CBC_SHA</font><br>
<font size="2" face="sans-serif">May 4 15:47:31 04[TLS] received cipher suites inacceptable</font><br>
<font size="2" face="sans-serif">May 4 15:47:31 04[TLS] sending fatal TLS alert 'handshake failure'</font><br>
<font size="2" face="sans-serif">May 4 15:47:31 04[TLS] sending TLS Alert record (2 bytes)</font><br>
<br>
<font size="2" face="sans-serif">Is there some client config parm that can set the ciphe rsuite? If not, is ECDSA not supported for TNC?</font><br>
<br>
<br>
<br>
<font size="2" face="sans-serif">ps. Andreas Steffan, thank you for your response to my post a few weeks ago. That solved the problem.</font><br>
<br>
<br>
<font size="2" face="sans-serif"><br>
Terry Hennessy<br>
</font></body></html>