<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Texte brut Car";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.5pt;
font-family:Consolas;}
span.TextebrutCar
{mso-style-name:"Texte brut Car";
mso-style-priority:99;
mso-style-link:"Texte brut";
font-family:Consolas;}
.MsoChpDefault
{mso-style-type:export-only;}
@page Section1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=FR link=blue vlink=purple>
<div class=Section1>
<p class=MsoPlainText>Hello,<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>I am sorry but after updating carol's ocsp certificates
according to the patch, both tests “ikev2/ocsp-signer-cert” and “ikev2/ocsp-timeouts-good”
still fail... Here is moon's <i>daemon.log</i> file from test "ikev2/ocsp-signer-cert"
:<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>Apr 3 15:53:56 moon charon: 00[DMN] Starting IKEv2
charon daemon (strongSwan 4.6.2) <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:56 moon charon: 00[CFG] loading ca
certificates from '/etc/ipsec.d/cacerts' <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:56 moon charon: 00[CFG] loaded ca
certificate "C=CH, O=Linux strongSwan, CN=strongSwan Root CA" from
'/etc/ipsec.d/cacerts/strongswanCert.pem' <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:56 moon charon: 00[CFG] loading aa
certificates from '/etc/ipsec.d/aacerts' <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:56 moon charon: 00[CFG] loading ocsp signer
certificates from '/etc/ipsec.d/ocspcerts' <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:56 moon charon: 00[CFG] loading attribute
certificates from '/etc/ipsec.d/acerts' <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:56 moon charon: 00[CFG] loading crls from
'/etc/ipsec.d/crls' <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:56 moon charon: 00[CFG] loading secrets from
'/etc/ipsec.secrets' <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:56 moon charon: 00[CFG] loaded RSA private
key from '/etc/ipsec.d/private/moonKey.pem' <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:56 moon charon: 00[KNL] listening on
interfaces: <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:56 moon charon: 00[KNL] eth0 <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:56 moon charon: 00[KNL] 192.168.0.1 <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:56 moon charon: 00[KNL] fec0::1 <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:56 moon charon: 00[KNL]
fe80::fcfd:c0ff:fea8:1 <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:56 moon charon: 00[KNL] eth1 <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:56 moon charon: 00[KNL] 10.1.0.1 <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:56 moon charon: 00[KNL] fec1::1 <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:56 moon charon: 00[KNL]
fe80::fcfd:aff:fe01:1 <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:56 moon charon: 00[DMN] loaded plugins: curl
aes des sha1 sha2 md5 pem pkcs1 gmp random x509 revocation hmac xcbc stroke
kernel-netlink socket-default <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:56 moon charon: 00[JOB] spawning 16 worker
threads <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:56 moon charon: 14[CFG] received stroke: add
connection 'rw' <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:56 moon charon: 14[CFG] loaded certificate
"C=CH, O=Linux strongSwan, CN=moon.strongswan.org" from
'moonCert.pem' <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:56 moon charon: 14[CFG] added configuration
'rw' <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:59 moon charon: 06[NET] received packet:
from 192.168.0.100[500] to 192.168.0.1[500] <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:59 moon charon: 06[ENC] parsed IKE_SA_INIT
request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ] <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:59 moon charon: 06[IKE] 192.168.0.100 is
initiating an IKE_SA <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:59 moon charon: 06[IKE] sending cert request
for "C=CH, O=Linux strongSwan, CN=strongSwan Root CA" <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:59 moon charon: 06[ENC] generating
IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ
N(MULT_AUTH) ] <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:59 moon charon: 06[NET] sending packet: from
192.168.0.1[500] to 192.168.0.100[500] <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:59 moon charon: 07[NET] received packet:
from 192.168.0.100[4500] to 192.168.0.1[4500] <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:59 moon charon: 07[ENC] parsed IKE_AUTH
request 1 [ IDi CERT N(INIT_CONTACT) CERTREQ IDr AUTH SA TSi TSr N(MOBIKE_SUP)
N(ADD_6_ADDR) N(MULT_AUTH) N(EAP_ONLY) ] <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:59 moon charon: 07[IKE] received cert
request for "C=CH, O=Linux strongSwan, CN=strongSwan Root CA" <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:59 moon charon: 07[IKE] received end entity
cert "C=CH, O=Linux strongSwan, OU=OCSP, CN=carol@strongswan.org" <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:59 moon charon: 07[CFG] looking for peer
configs matching
192.168.0.1[moon.strongswan.org]...192.168.0.100[carol@strongswan.org] <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:59 moon charon: 07[CFG] selected peer config
'rw' <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:59 moon charon: 07[CFG] using certificate
"C=CH, O=Linux strongSwan, OU=OCSP, CN=carol@strongswan.org" <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:59 moon charon: 07[CFG] using trusted ca
certificate "C=CH, O=Linux strongSwan, CN=strongSwan Root CA" <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:59 moon charon: 07[CFG] checking certificate
status of "C=CH, O=Linux strongSwan, OU=OCSP,
CN=carol@strongswan.org" <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:59 moon charon: 07[CFG] requesting ocsp
status from 'http://ocsp.strongswan.org:8880' ... <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:59 moon charon: 07[CFG] using certificate
"C=CH, O=Linux strongSwan, OU=OCSP Signing Authority,
CN=ocsp.strongswan.org" <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:59 moon charon: 07[CFG] using trusted ca
certificate "C=CH, O=Linux strongSwan, CN=strongSwan Root CA" <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:59 moon charon: 07[CFG] reached
self-signed root ca with a path length of 0 <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:59 moon charon: 07[CFG] ocsp response
correctly signed by "C=CH, O=Linux strongSwan, OU=OCSP Signing Authority,
CN=ocsp.strongswan.org" <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:59 moon charon: 07[CFG] ocsp response
contains no status on our certificate <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:59 moon charon: 07[CFG] <b><span
style='color:red'>ocsp check failed, fallback to crl</span></b> <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:59 moon charon: 07[CFG] fetching crl from
'http://crl.strongswan.org/strongswan.crl' ... <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:59 moon charon: 07[CFG] using trusted
certificate "C=CH, O=Linux strongSwan, CN=strongSwan Root CA" <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:59 moon charon: 07[CFG] crl correctly
signed by "C=CH, O=Linux strongSwan, CN=strongSwan Root CA" <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:59 moon charon: 07[CFG] crl is valid:
until May 03 15:49:26 2012 <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:59 moon charon: 07[CFG] certificate status
is good <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:59 moon charon: 07[CFG] reached
self-signed root ca with a path length of 0 <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:59 moon charon: 07[IKE] authentication of
'carol@strongswan.org' with RSA signature successful <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:59 moon charon: 07[IKE] peer supports MOBIKE
<o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:59 moon charon: 07[IKE] authentication of
'moon.strongswan.org' (myself) with RSA signature successful <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:59 moon charon: 07[IKE] IKE_SA rw[1]
established between
192.168.0.1[moon.strongswan.org]...192.168.0.100[carol@strongswan.org] <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:59 moon charon: 07[IKE] scheduling
reauthentication in 3348s <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:59 moon charon: 07[IKE] maximum IKE_SA
lifetime 3528s <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:59 moon charon: 07[IKE] sending end entity
cert "C=CH, O=Linux strongSwan, CN=moon.strongswan.org" <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:59 moon charon: 07[IKE] CHILD_SA rw{1}
established with SPIs c6235c4c_i c7a5fcbe_o and TS 10.1.0.0/16 ===
192.168.0.100/32 <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:59 moon charon: 07[ENC] generating IKE_AUTH
response 1 [ IDr CERT AUTH SA TSi TSr N(AUTH_LFT) N(MOBIKE_SUP) N(ADD_4_ADDR)
N(ADD_6_ADDR) N(ADD_6_ADDR) ] <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:53:59 moon charon: 07[NET] sending packet: from
192.168.0.1[4500] to 192.168.0.100[4500] <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:54:03 moon charon: 00[DMN] signal of type
SIGINT received. Shutting down <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:54:03 moon charon: 00[IKE] deleting IKE_SA
rw[1] between 192.168.0.1[moon.strongswan.org]...192.168.0.100[carol@strongswan.org]
<o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:54:03 moon charon: 00[IKE] sending DELETE for
IKE_SA rw[1] <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:54:03 moon charon: 00[ENC] generating
INFORMATIONAL request 0 [ D ] <o:p></o:p></p>
<p class=MsoPlainText>Apr 3 15:54:03 moon charon: 00[NET] sending packet: from
192.168.0.1[4500] to 192.168.0.100[4500]<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>Is that normal ?<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>Thanks,<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>Stéphanie<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>-----Message d'origine-----<br>
De : Andreas Steffen [mailto:andreas.steffen@strongswan.org] <br>
Envoyé : lundi 2 avril 2012 15:08<br>
À : NGO MAEMBLE Ruth-Stephanie<br>
Cc : users@lists.strongswan.org<br>
Objet : Re: [strongSwan] Certificates no longer valid<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>Hello Stéphanie,<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>the expired OCSP key/certificate pair was renewed with
the following<o:p></o:p></p>
<p class=MsoPlainText>patch:<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>http://git.strongswan.org/?p=strongswan.git;a=commit;h=ebf292bad0bd4cafb6edc3f49ae35804277874ea<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>The updated test will be contained in the upcoming
4.6.3dr2 release.<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>Regards<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>Andreas<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>On 02.04.2012 14:53, NGO MAEMBLE Ruth-Stephanie wrote:<o:p></o:p></p>
<p class=MsoPlainText>> Hello,<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> I'm working on the automated tests of
strongSwan-4.6.2. I have a problem<o:p></o:p></p>
<p class=MsoPlainText>> with two tests of yours :
“ikev2/ocsp-signer-cert” and<o:p></o:p></p>
<p class=MsoPlainText>> “ikev2/ocsp-timeouts-good”. The second
one is based on the first. Both<o:p></o:p></p>
<p class=MsoPlainText>> indicate a certificate invalidity (see moon’s
/daemon.log/ file below).<o:p></o:p></p>
<p class=MsoPlainText>> On your website they probably passed because you
launched them on<o:p></o:p></p>
<p class=MsoPlainText>> February 20^th 2012, and these certificate were
valid until February<o:p></o:p></p>
<p class=MsoPlainText>> 24^th 2012.<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> Could you please let me know if there is an
evolution of these tests ?<o:p></o:p></p>
<p class=MsoPlainText>> Should I regenerate certificates by myself to pass
them ?<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> Moon’s /daemon.log/ file extracted from the
test “ikev2/ocsp-signer-cert” :<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:20 moon charon: 00[DMN] Starting IKEv2
charon daemon<o:p></o:p></p>
<p class=MsoPlainText>> (strongSwan 4.6.2) /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:20 moon charon: 00[CFG] loading ca
certificates from<o:p></o:p></p>
<p class=MsoPlainText>> '/etc/ipsec.d/cacerts' /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:20 moon charon: 00[CFG] loaded ca
certificate "C=CH,<o:p></o:p></p>
<p class=MsoPlainText>> O=Linux strongSwan, CN=strongSwan Root CA" from<o:p></o:p></p>
<p class=MsoPlainText>> '/etc/ipsec.d/cacerts/strongswanCert.pem' /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:20 moon charon: 00[CFG] loading aa
certificates from<o:p></o:p></p>
<p class=MsoPlainText>> '/etc/ipsec.d/aacerts' /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:20 moon charon: 00[CFG] loading ocsp
signer certificates<o:p></o:p></p>
<p class=MsoPlainText>> from '/etc/ipsec.d/ocspcerts' /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:20 moon charon: 00[CFG] loading
attribute certificates<o:p></o:p></p>
<p class=MsoPlainText>> from '/etc/ipsec.d/acerts' /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:20 moon charon: 00[CFG] loading crls
from<o:p></o:p></p>
<p class=MsoPlainText>> '/etc/ipsec.d/crls' /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:20 moon charon: 00[CFG] loading
secrets from<o:p></o:p></p>
<p class=MsoPlainText>> '/etc/ipsec.secrets' /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:20 moon charon: 00[CFG] loaded RSA
private key from<o:p></o:p></p>
<p class=MsoPlainText>> '/etc/ipsec.d/private/moonKey.pem' /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:20 moon charon: 00[KNL] listening on
interfaces: /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:20 moon charon: 00[KNL] eth0 /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:20 moon charon: 00[KNL]
192.168.0.1 /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:20 moon charon: 00[KNL] fec0::1 /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:20 moon charon: 00[KNL]
fe80::fcfd:c0ff:fea8:1 /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:20 moon charon: 00[KNL] eth1 /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:20 moon charon: 00[KNL] 10.1.0.1 /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:20 moon charon: 00[KNL] fec1::1 /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:20 moon charon: 00[KNL]
fe80::fcfd:aff:fe01:1 /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:20 moon charon: 00[DMN] loaded
plugins: curl aes des sha1<o:p></o:p></p>
<p class=MsoPlainText>> sha2 md5 pem pkcs1 gmp random x509 revocation hmac
xcbc stroke<o:p></o:p></p>
<p class=MsoPlainText>> kernel-netlink socket-default /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:20 moon charon: 00[JOB] spawning 16
worker threads /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:20 moon charon: 08[CFG] received
stroke: add ca<o:p></o:p></p>
<p class=MsoPlainText>> 'strongswan-ca' /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:20 moon charon: 08[CFG] added ca
'strongswan-ca' /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:20 moon charon: 09[CFG] received stroke:
add connection 'rw' /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:20 moon charon: 09[CFG] loaded
certificate "C=CH,<o:p></o:p></p>
<p class=MsoPlainText>> O=Linux strongSwan, CN=moon.strongswan.org"
from 'moonCert.pem' /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:20 moon charon: 09[CFG] added
configuration 'rw' /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:22 moon charon: 05[NET] received
packet: from<o:p></o:p></p>
<p class=MsoPlainText>> 192.168.0.100[500] to 192.168.0.1[500] /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:22 moon charon: 05[ENC] parsed
IKE_SA_INIT request 0 [ SA<o:p></o:p></p>
<p class=MsoPlainText>> KE No N(NATD_S_IP) N(NATD_D_IP) ] /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:22 moon charon: 05[IKE] 192.168.0.100
is initiating an<o:p></o:p></p>
<p class=MsoPlainText>> IKE_SA /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:23 moon charon: 05[IKE] sending cert
request for "C=CH,<o:p></o:p></p>
<p class=MsoPlainText>> O=Linux strongSwan, CN=strongSwan Root CA" /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:23 moon charon: 05[ENC] generating
IKE_SA_INIT response 0<o:p></o:p></p>
<p class=MsoPlainText>> [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ
N(MULT_AUTH) ] /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:23 moon charon: 05[NET] sending
packet: from<o:p></o:p></p>
<p class=MsoPlainText>> 192.168.0.1[500] to 192.168.0.100[500] /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:23 moon charon: 04[NET] received
packet: from<o:p></o:p></p>
<p class=MsoPlainText>> 192.168.0.100[4500] to 192.168.0.1[4500] /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:23 moon charon: 04[ENC] parsed
IKE_AUTH request 1 [ IDi<o:p></o:p></p>
<p class=MsoPlainText>> CERT N(INIT_CONTACT) CERTREQ IDr AUTH SA TSi TSr
N(MOBIKE_SUP)<o:p></o:p></p>
<p class=MsoPlainText>> N(ADD_6_ADDR) N(MULT_AUTH) N(EAP_ONLY) ] /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:23 moon charon: 04[IKE] received cert
request for "C=CH,<o:p></o:p></p>
<p class=MsoPlainText>> O=Linux strongSwan, CN=strongSwan Root CA" /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:23 moon charon: 04[IKE] received end
entity cert "C=CH,<o:p></o:p></p>
<p class=MsoPlainText>> O=Linux strongSwan, OU=OCSP, CN=carol@strongswan.org<o:p></o:p></p>
<p class=MsoPlainText>> <mailto:CN=carol@strongswan.org>" /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:23 moon charon: 04[CFG] looking for
peer configs matching<o:p></o:p></p>
<p class=MsoPlainText>>
192.168.0.1[moon.strongswan.org]...192.168.0.100[carol@strongswan.org] /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:23 moon charon: 04[CFG] selected peer
config 'rw' /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:23 moon charon: 04[CFG] using
certificate "C=CH, O=Linux<o:p></o:p></p>
<p class=MsoPlainText>> strongSwan, OU=OCSP, CN=carol@strongswan.org<o:p></o:p></p>
<p class=MsoPlainText>> <mailto:CN=carol@strongswan.org>" /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:23 moon charon: 04[CFG] using
trusted ca certificate<o:p></o:p></p>
<p class=MsoPlainText>> "C=CH, O=Linux strongSwan, CN=strongSwan Root
CA" /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:23 moon charon: 04[CFG] subject
certificate invalid (valid<o:p></o:p></p>
<p class=MsoPlainText>> from Feb 25 08:58:57 2007 to Feb 24 08:58:57 2012) /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:23 moon charon: 04[IKE] no trusted RSA
public key found<o:p></o:p></p>
<p class=MsoPlainText>> for 'carol@strongswan.org' /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:23 moon charon: 04[IKE] peer supports
MOBIKE /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:23 moon charon: 04[ENC] generating
IKE_AUTH response 1 [<o:p></o:p></p>
<p class=MsoPlainText>> N(AUTH_FAILED) ] /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:23 moon charon: 04[NET] sending
packet: from<o:p></o:p></p>
<p class=MsoPlainText>> 192.168.0.1[4500] to 192.168.0.100[4500] /<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> /Mar 28 21:23:26 moon charon: 00[DMN] signal of type
SIGINT received.<o:p></o:p></p>
<p class=MsoPlainText>> Shutting down/<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> Thanks and best regards,<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> Stéphanie Ngo Maemble<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>======================================================================<o:p></o:p></p>
<p class=MsoPlainText>Andreas Steffen
andreas.steffen@strongswan.org<o:p></o:p></p>
<p class=MsoPlainText>strongSwan - the Linux VPN Solution!
www.strongswan.org<o:p></o:p></p>
<p class=MsoPlainText>Institute for Internet Technologies and Applications<o:p></o:p></p>
<p class=MsoPlainText>University of Applied Sciences Rapperswil<o:p></o:p></p>
<p class=MsoPlainText>CH-8640 Rapperswil (Switzerland)<o:p></o:p></p>
<p class=MsoPlainText>===========================================================[ITA-HSR]==<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
</div>
</body>
</html>