<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; "><div><div><div><br></div></div></div><span id="OLK_SRC_BODY_SECTION"><div><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; "><div><div><div>Hello,</div><div><br></div><div>I got RSA 2048-bit certificate StrongSwan to work on an SEAndroid device. However, when I tried it with an AES-256 certificate, I get this error:</div><div><br></div><div><div>I/charon ( 1035): 00[LIB] building CRED_PRIVATE_KEY - ECDSA failed, tried 1 builders</div><div>I/charon ( 1035): 00[CFG] loading private key from '/system/etc/ipsec.d/private/carolKey.pem' failed</div><div>I/charon ( 1035): 00[DMN] loaded plugins: openssl fips-prf random pubkey pkcs1 pem xcbc hmac kernel-netlink socket-default android stroke eap-identity eap-mschapv2 eap-md5</div></div><div><div><br></div><div>The same AES-256 certs and configurations worked fine on an Ubuntu PC platform. Please advise if you had seen this before.</div><div><br></div><div>Cheers,</div><div><br></div><div>Below are the configurations:</div><div><br></div><div># /etc/ipsec.conf - strongSwan IPsec configuration file</div><div> </div><div> config setup</div><div> <span class="Apple-tab-span" style="white-space:pre"> </span>crlcheckinterval=180</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>strictcrlpolicy=no</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>plutostart=no</div><div><br></div><div>conn %default</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>ikelifetime=60m</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>keylife=20m</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>rekeymargin=3m</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>keyingtries=1</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>keyexchange=ikev2</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>ike=aes256-sha384-ecp384,aes128-sha256-ecp256!</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>esp=aes256gcm16,aes128gcm16!</div><div><br></div><div>conn rw</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>left=192.168.1.140</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>leftcert=moonCert.pem</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>leftsubnet=10.1.0.0/16</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>leftfirewall=yes</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>right=%any</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>keyexchange=ikev2</div><div>auto=add</div><div><br></div><div># /etc/ipsec.secrets - strongSwan IPsec secrets file</div><div><br></div><div>: ECDSA moonKey.pem</div><div><br></div><div><br></div></div><div><div><div><p></p></div></div></div></div></div></div></div></span></body></html>