<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 12 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:"Arial Unicode MS";
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"\@Arial Unicode MS";
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
text-align:justify;
text-justify:inter-ideograph;
font-size:10.5pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Arial Unicode MS","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
/* Page Definitions */
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=ZH-CN link=blue vlink=purple style='text-justify-trim:punctuation'><div class=WordSection1><p class=MsoNormal><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'>Hello,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'><o:p> </o:p></span></p><p class=MsoNormal><b><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'>first I use strongswan v4.5.2 in my centos 5.5.<o:p></o:p></span></b></p><p class=MsoNormal><b><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'>when ipsec daemon start, I found /etc/ipsec.d/crls/crl.pem loaded successfully:<o:p></o:p></span></b></p><p class=MsoNormal><b><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'><o:p> </o:p></span></b></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'>Jul 23 03:06:20 lag3 pluto[30328]: loading aa certificates from '/etc/ipsec.d/aacerts' <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'>Jul 23 03:06:20 lag3 pluto[30328]: loading ocsp certificates from '/etc/ipsec.d/ocspcerts'<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'>Jul 23 03:06:20 lag3 pluto[30328]: Changing to directory '/etc/ipsec.d/crls'<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'>Jul 23 03:06:20 lag3 pluto[30328]: loaded crl from 'crl.der'<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'>Jul 23 03:06:20 lag3 pluto[30328]: loading attribute certificates from '/etc/ipsec.d/acerts'<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'>Jul 23 03:06:20 lag3 pluto[30328]: spawning 4 worker threads <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'>Jul 23 03:06:20 lag3 ipsec_starter[30327]: pluto (30328) started after 20 ms<o:p></o:p></span></p><p class=MsoNormal><b><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'><o:p> </o:p></span></b></p><p class=MsoNormal><b><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'>And<o:p></o:p></span></b></p><p class=MsoNormal><b><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'><o:p> </o:p></span></b></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'>Jul 23 03:06:20 lag3 charon: 00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'>Jul 23 03:06:20 lag3 charon: 00[CFG] loaded ca certificate "C=US, ST=CO, L=Denver, O=igvpn.com, CN=igvpn.com CA, E=info@igvpn.com" from '/etc/ipsec.d/cacerts/ca.crt' <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'>Jul 23 03:06:20 lag3 charon: 00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts' <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'>Jul 23 03:06:20 lag3 charon: 00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'>Jul 23 03:06:20 lag3 charon: 00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'>Jul 23 03:06:20 lag3 charon: 00[CFG] loading crls from '/etc/ipsec.d/crls' <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'>Jul 23 03:06:20 lag3 charon: 00[CFG] loaded crl from '/etc/ipsec.d/crls/crl.der' <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'>Jul 23 03:06:20 lag3 charon: 00[CFG] loading secrets from '/etc/ipsec.secrets'<o:p></o:p></span></p><p class=MsoNormal><b><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'><o:p> </o:p></span></b></p><p class=MsoNormal><b><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'>Actually, I have 30 certificates revoked in my CRLs.<o:p></o:p></span></b></p><p class=MsoNormal><b><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'>#ipsec listcrls<o:p></o:p></span></b></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'>000 <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'>000 List of X.509 CRLs:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'>000 <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'>000 issuer: "C=US, ST=CO, L=Denver, O=igvpn.com, CN=igvpn.com CA, E=info@igvpn.com"<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'>000 revoked: 30 certificates<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'>000 distPts: 'file:///etc/ipsec.d/crls/crl.der'<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'>000 updates: this Jul 21 00:31:08 2011<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'>000 next Aug 20 00:31:08 2011 ok<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'>List of X.509 CRLs:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'> issuer: "C=US, ST=CO, L=Denver, O=igvpn.com, CN=igvpn.com CA, E=info@igvpn.com"<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'> revoked: 30 certificates<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'> updates: this Jul 21 00:31:08 2011<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'> next Aug 20 00:31:08 2011, ok<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'><o:p> </o:p></span></p><p class=MsoNormal><b><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'>I use one of the revoked certificate to connect to my Strongswan server, the IKEv1 daemon Pluto can correctly reject this certs:<o:p></o:p></span></b></p><div style='mso-element:para-border-div;border:none;border-bottom:solid windowtext 1.0pt;padding:0cm 0cm 1.0pt 0cm'><p class=MsoNormal style='border:none;padding:0cm'><span lang=EN-US><o:p> </o:p></span></p></div><p class=MsoNormal><span lang=EN-US>ul 23 12:16:23 lag3 pluto[4778]: packet from 218.249.58.137:1117: size (1160) differs from size specified in ISAKMP HDR (1144)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:16:23 lag3 pluto[4778]: packet from 218.249.58.137:1117: Cisco VPN client appends 16 surplus NULL bytes<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:16:23 lag3 pluto[4778]: packet from 218.249.58.137:1117: received Vendor ID payload [XAUTH]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:16:23 lag3 pluto[4778]: packet from 218.249.58.137:1117: received Vendor ID payload [Dead Peer Detection]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:16:23 lag3 pluto[4778]: packet from 218.249.58.137:1117: ignoring Vendor ID payload [FRAGMENTATION 80000000]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:16:23 lag3 pluto[4778]: packet from 218.249.58.137:1117: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:16:23 lag3 pluto[4778]: packet from 218.249.58.137:1117: ignoring Vendor ID payload [Cisco-Unity]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:16:23 lag3 pluto[4778]: "RW_IKEv1_RSA_XAUTH"[11] 218.249.58.137:1117 #21: responding to Main Mode from unknown peer 218.249.58.137:1117<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:16:23 lag3 pluto[4778]: "RW_IKEv1_RSA_XAUTH"[11] 218.249.58.137:1117 #21: peer requested 2147483 seconds which exceeds our limit 86400 seconds<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:16:23 lag3 pluto[4778]: "RW_IKEv1_RSA_XAUTH"[11] 218.249.58.137:1117 #21: lifetime reduced to 86400 seconds (todo: IPSEC_RESPONDER_LIFETIME notification)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:16:23 lag3 pluto[4778]: packet from 218.249.58.137:1117: size (352) differs from size specified in ISAKMP HDR (336)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:16:23 lag3 pluto[4778]: packet from 218.249.58.137:1117: Cisco VPN client appends 16 surplus NULL bytes<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:16:23 lag3 pluto[4778]: "RW_IKEv1_RSA_XAUTH"[11] 218.249.58.137:1117 #21: ignoring Vendor ID payload [b86d2f5e92fd6cffdb3255aa8b2cc015]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:16:23 lag3 pluto[4778]: "RW_IKEv1_RSA_XAUTH"[11] 218.249.58.137:1117 #21: ignoring Vendor ID payload [Cisco-Unity]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:16:23 lag3 pluto[4778]: "RW_IKEv1_RSA_XAUTH"[11] 218.249.58.137:1117 #21: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: peer is NATed<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:16:23 lag3 pluto[4778]: "RW_IKEv1_RSA_XAUTH"[11] 218.249.58.137:1117 #21: ignoring informational payload, type IPSEC_INITIAL_CONTACT<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:16:23 lag3 pluto[4778]: | protocol/port in Phase 1 ID Payload is 17/0. accepted with port_floating NAT-T<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:16:23 lag3 pluto[4778]: "RW_IKEv1_RSA_XAUTH"[11] 218.249.58.137:1117 #21: Peer ID is ID_DER_ASN1_DN: 'C=US, ST=CO, L=Denver, O=igvpn.com, CN=ccfer.igvpn.com, E=info@igvpn.com'<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:red'>Jul 23 12:16:23 lag3 pluto[4778]: "RW_IKEv1_RSA_XAUTH"[11] 218.249.58.137:1117 #21: certificate was revoked on Jul 20 16:29:25 UTC 2011, reason: unspecified<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:red'>Jul 23 12:16:23 lag3 pluto[4778]: "RW_IKEv1_RSA_XAUTH"[11] 218.249.58.137:1117 #21: X.509 certificate rejected<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:16:23 lag3 pluto[4778]: "RW_IKEv1_RSA_XAUTH"[11] 218.249.58.137:1117 #21: no public key known for 'C=US, ST=CO, L=Denver, O=igvpn.com, CN=ccfer.igvpn.com, E=info@igvpn.com'<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:16:23 lag3 pluto[4778]: "RW_IKEv1_RSA_XAUTH"[11] 218.249.58.137:1117 #21: sending encrypted notification INVALID_KEY_INFORMATION to 218.249.58.137:1117<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'>-------------------------<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'><o:p> </o:p></span></p><div style='mso-element:para-border-div;border:none;border-bottom:solid windowtext 1.0pt;padding:0cm 0cm 1.0pt 0cm'><p class=MsoNormal style='border:none;padding:0cm'><b><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'>but charon daemon still accept the certs:<o:p></o:p></span></b></p></div><p class=MsoNormal><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:25:42 lag3 charon: 08[IKE] 117.136.0.52 is initiating an IKE_SA <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:25:42 lag3 charon: 08[IKE] remote host is behind NAT <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:25:42 lag3 charon: 08[IKE] sending cert request for "C=US, ST=CO, L=Denver, O=igvpn.com, CN=igvpn.com CA, E=info@igvpn.com" <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:25:42 lag3 charon: 08[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(MULT_AUTH) ] <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:25:42 lag3 charon: 08[NET] sending packet: from 199.119.201.165[500] to 117.136.0.52[46643] <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:25:43 lag3 charon: 10[NET] received packet: from 117.136.0.52[46644] to 199.119.201.165[4500] <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:25:43 lag3 charon: 10[ENC] parsed IKE_AUTH request 1 [ IDi CERT N(INIT_CONTACT) CERTREQ AUTH CP(ADDR DNS) SA TSi TSr ] <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:25:43 lag3 charon: 10[IKE] received cert request for "C=US, ST=CO, L=Denver, O=igvpn.com, CN=igvpn.com CA, E=info@igvpn.com" <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:25:43 lag3 charon: 10[IKE] received end entity cert "C=US, ST=CO, L=Denver, O=igvpn.com, CN=ccfer.igvpn.com, E=info@igvpn.com" <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:25:43 lag3 charon: 10[CFG] looking for peer configs matching 199.119.201.165[%any]...117.136.0.52[C=US, ST=CO, L=Denver, O=igvpn.com, CN=ccfer.igvpn.com, E=info@igvpn.com] <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:25:43 lag3 charon: 10[CFG] selected peer config 'RW_IKEv2_RSA' <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:25:43 lag3 charon: 10[CFG] using certificate "C=US, ST=CO, L=Denver, O=igvpn.com, CN=ccfer.igvpn.com, E=info@igvpn.com" <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:25:43 lag3 charon: 10[CFG] using trusted ca certificate "C=US, ST=CO, L=Denver, O=igvpn.com, CN=igvpn.com CA, E=info@igvpn.com" <span style='color:red'><o:p></o:p></span></span></p><p class=MsoNormal><span lang=EN-US style='color:red'>Jul 23 12:25:43 lag3 charon: 10[CFG] checking certificate status of "C=US, ST=CO, L=Denver, O=igvpn.com, CN=ccfer.igvpn.com, E=info@igvpn.com" <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:red'>Jul 23 12:25:43 lag3 charon: 10[CFG] certificate status is not available <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:red'>Jul 23 12:25:43 lag3 charon: 10[CFG] reached self-signed root ca with a path length of 0 <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:red'>Jul 23 12:25:43 lag3 charon: 10[IKE] authentication of 'C=US, ST=CO, L=Denver, O=igvpn.com, CN=ccfer.igvpn.com, E=info@igvpn.com' with RSA signature successful <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:25:43 lag3 charon: 10[IKE] authentication of 'lag3.igvpn.com' (myself) with RSA signature successful <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:25:43 lag3 charon: 10[IKE] IKE_SA RW_IKEv2_RSA[3] established between 199.119.201.165[lag3.igvpn.com]...117.136.0.52[C=US, ST=CO, L=Denver, O=igvpn.com, CN=ccfer.igvpn.com, E=info@igvpn.com] <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:25:43 lag3 charon: 10[IKE] scheduling reauthentication in 10207s <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:25:43 lag3 charon: 10[IKE] maximum IKE_SA lifetime 10747s <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:25:43 lag3 charon: 10[IKE] sending end entity cert "C=US, ST=CO, L=Denver, O=igvpn.com, CN=lag3.igvpn.com, E=info@igvpn.com" <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:25:43 lag3 charon: 10[IKE] peer requested virtual IP %any <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:25:43 lag3 charon: 10[CFG] reassigning offline lease to 'C=US, ST=CO, L=Denver, O=igvpn.com, CN=ccfer.igvpn.com, E=info@igvpn.com' <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:25:43 lag3 charon: 10[IKE] assigning virtual IP 10.0.6.3 to peer 'C=US, ST=CO, L=Denver, O=igvpn.com, CN=ccfer.igvpn.com, E=info@igvpn.com' <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:25:43 lag3 charon: 10[IKE] CHILD_SA RW_IKEv2_RSA{3} established with SPIs c0c373b1_i 1228f27d_o and TS 0.0.0.0/0 === 10.0.6.3/32 <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:25:43 lag3 vpn: + C=US, ST=CO, L=Denver, O=igvpn.com, CN=ccfer.igvpn.com, E=info@igvpn.com 10.0.6.3/32 == 117.136.0.52 -- 199.119.201.165 == 0.0.0.0/0<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:25:43 lag3 charon: 10[ENC] generating IKE_AUTH response 1 [ IDr CERT AUTH CP(ADDR DNS NBNS DNS NBNS) SA TSi TSr N(AUTH_LFT) ] <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:25:43 lag3 charon: 10[NET] sending packet: from 199.119.201.165[4500] to 117.136.0.52[46644] <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:25:52 lag3 charon: 11[NET] received packet: from 117.136.0.52[46644] to 199.119.201.165[4500] <o:p></o:p></span></p><div style='mso-element:para-border-div;border:none;border-bottom:solid windowtext 1.0pt;padding:0cm 0cm 1.0pt 0cm'><p class=MsoNormal style='border:none;padding:0cm'><span lang=EN-US style='font-family:"Arial Unicode MS","sans-serif"'><o:p> </o:p></span></p></div><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><b><span lang=EN-US>My original ipsec.conf<o:p></o:p></span></b></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>config setup<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> plutostart=yes<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> #plutodebug=control<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> #plutodebug=all<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> uniqueids=yes<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> nat_traversal=yes<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> charonstart=yes<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> strictcrlpolicy=no<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> virtual_private=%v4:10.0.0.0/8,%v4:172.16.0.0/12,%v4:192.168.0.0/16,%v4:!172.19.32.0/24<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><b><span lang=EN-US>When I change ipsec.conf to this:<o:p></o:p></span></b></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>config setup<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> plutostart=yes<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> #plutodebug=control<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> #plutodebug=all<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> uniqueids=yes<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> nat_traversal=yes<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> charonstart=yes<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> crlcheckinterval=600s<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> strictcrlpolicy=yes<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> charondebug="ike control"<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> virtual_private=%v4:10.0.0.0/8,%v4:172.16.0.0/12,%v4:192.168.0.0/16,%v4:!172.19.32.0/24<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>ca IGVPN<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> cacert=ca.crt<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> crluri="http://www.igvpn.com:8000/crl/crl.der"<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> auto=add<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><b><span lang=EN-US>and restart ipsec daemon, I use the revoked certs to connect to Strongswan using IKEv2, I found something different in charon log:<o:p></o:p></span></b></p><p class=MsoNormal><b><span lang=EN-US><o:p> </o:p></span></b></p><p class=MsoNormal><b><span lang=EN-US>------------------------<o:p></o:p></span></b></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:41:26 lag3 charon: 08[IKE] 117.136.0.7 is initiating an IKE_SA <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:41:26 lag3 charon: 08[IKE] remote host is behind NAT <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:41:26 lag3 charon: 08[IKE] sending cert request for "C=US, ST=CO, L=Denver, O=igvpn.com, CN=igvpn.com CA, E=info@igvpn.com" <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:41:26 lag3 charon: 08[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(MULT_AUTH) ] <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:41:26 lag3 charon: 08[NET] sending packet: from 199.119.201.165[500] to 117.136.0.7[41191] <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:41:28 lag3 charon: 03[NET] received packet: from 117.136.0.7[29600] to 199.119.201.165[4500] <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:41:28 lag3 charon: 03[ENC] parsed IKE_AUTH request 1 [ IDi CERT N(INIT_CONTACT) CERTREQ AUTH CP(ADDR DNS) SA TSi TSr ] <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:41:28 lag3 charon: 03[IKE] received cert request for "C=US, ST=CO, L=Denver, O=igvpn.com, CN=igvpn.com CA, E=info@igvpn.com" <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:41:28 lag3 charon: 03[IKE] received end entity cert "C=US, ST=CO, L=Denver, O=igvpn.com, CN=ccfer.igvpn.com, E=info@igvpn.com" <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:41:28 lag3 charon: 03[CFG] looking for peer configs matching 199.119.201.165[%any]...117.136.0.7[C=US, ST=CO, L=Denver, O=igvpn.com, CN=ccfer.igvpn.com, E=info@igvpn.com] <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:41:28 lag3 charon: 03[CFG] selected peer config 'RW_IKEv2_RSA' <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:41:28 lag3 charon: 03[CFG] using certificate "C=US, ST=CO, L=Denver, O=igvpn.com, CN=ccfer.igvpn.com, E=info@igvpn.com" <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:41:28 lag3 charon: 03[CFG] using trusted ca certificate "C=US, ST=CO, L=Denver, O=igvpn.com, CN=igvpn.com CA, E=info@igvpn.com" <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:41:28 lag3 charon: 03[CFG] checking certificate status of "C=US, ST=CO, L=Denver, O=igvpn.com, CN=ccfer.igvpn.com, E=info@igvpn.com" <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:red'>Jul 23 12:41:28 lag3 charon: 03[CFG] fetching crl from 'http://www.igvpn.com:8000/crl/crl.der' ... <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:red'>Jul 23 12:41:28 lag3 charon: 03[CFG] issuer of fetched CRL 'C=US, ST=CO, L=Denver, O=igvpn.com, CN=igvpn.com CA, E=info@igvpn.com' does not match CRL issuer '9b:00:ad:ef:3d:af:74:3b:72:6e:28:33:f5:33:4a:6a:e8:77:2e:bb' <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:red'>Jul 23 12:41:28 lag3 charon: 03[CFG] certificate status is not available <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:41:28 lag3 charon: 03[CFG] reached self-signed root ca with a path length of 0 <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:41:28 lag3 charon: 03[IKE] authentication of 'C=US, ST=CO, L=Denver, O=igvpn.com, CN=ccfer.igvpn.com, E=info@igvpn.com' with RSA signature successful <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:41:28 lag3 charon: 03[CFG] constraint check failed: RULE_OCSP_VALIDATION is FAILED, but requires at least GOOD <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:41:28 lag3 charon: 03[CFG] selected peer config 'RW_IKEv2_RSA' inacceptable <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:41:28 lag3 charon: 03[CFG] switching to peer config 'RW_IKEv2_MSEAPV2' <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:41:28 lag3 charon: 03[CFG] constraint requires EAP authentication, but public key was used <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:41:28 lag3 charon: 03[CFG] selected peer config 'RW_IKEv2_MSEAPV2' inacceptable <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:41:28 lag3 charon: 03[CFG] switching to peer config 'RW_IKEv1_RSA' <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:41:28 lag3 charon: 03[CFG] constraint check failed: RULE_OCSP_VALIDATION is FAILED, but requires at least GOOD <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:41:28 lag3 charon: 03[CFG] selected peer config 'RW_IKEv1_RSA' inacceptable <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:41:28 lag3 charon: 03[CFG] switching to peer config 'RW_IKEv1_PSK_XAUTH' <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:41:28 lag3 charon: 03[CFG] constraint check failed: RULE_OCSP_VALIDATION is FAILED, but requires at least GOOD <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:41:28 lag3 charon: 03[CFG] selected peer config 'RW_IKEv1_PSK_XAUTH' inacceptable <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:41:28 lag3 charon: 03[CFG] switching to peer config 'RW_IKEv1_RSA_XAUTH' <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:41:28 lag3 charon: 03[CFG] constraint check failed: RULE_OCSP_VALIDATION is FAILED, but requires at least GOOD <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:41:28 lag3 charon: 03[CFG] selected peer config 'RW_IKEv1_RSA_XAUTH' inacceptable <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:41:28 lag3 charon: 03[CFG] switching to peer config 'RW_IKEv1_L2TP_PSK' <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:41:28 lag3 charon: 03[CFG] constraint check failed: RULE_OCSP_VALIDATION is FAILED, but requires at least GOOD <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:41:28 lag3 charon: 03[CFG] selected peer config 'RW_IKEv1_L2TP_PSK' inacceptable <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:41:28 lag3 charon: 03[CFG] no alternative config found <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:41:28 lag3 charon: 03[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ] <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Jul 23 12:41:28 lag3 charon: 03[NET] sending packet: from 199.119.201.165[4500] to 117.136.0.7[29600]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>Please help.<o:p></o:p></span></p></div></body></html>