<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); "><div><div><div style="font-family: Calibri, sans-serif; font-size: 14px; "><div style="font-family: Consolas; font-size: medium; ">Hello,</div><div style="font-family: Consolas; font-size: medium; "><br></div><div style="font-family: Consolas; font-size: medium; ">I am getting a constraint check failed error while using the StrongSwan Android VPN Client with valid certificates that have been working with StrongSwan on desktops:</div><div style="font-family: Consolas; font-size: medium; "><br></div><div style="font-family: Consolas; font-size: medium; "><span class="Apple-style-span" style="font-size: 14px; font-family: Calibri, sans-serif; "><div style="font-family: Consolas; font-size: medium; ">[CFG] constraint check failed: identity</div><div style="font-family: Consolas; font-size: medium; ">'192.168.24.2' required</div></span></div><div style="font-family: Consolas; font-size: medium; "><br></div><div style="font-family: Consolas; font-size: medium; ">Can you help me with debugging this error? These are self-signed certificates that have been validated with OpenSSL.</div><div style="font-family: Consolas; font-size: medium; "><br></div><div style="font-family: Consolas; font-size: medium; ">Thank you,</div><div style="font-family: Consolas; font-size: medium; "><br></div><div style="font-family: Consolas; font-size: medium; ">I/charon ( 5507): 01[IKE] initiating IKE_SA android[4] to 192.168.24.2</div><div style="font-family: Consolas; font-size: medium; ">I/charon ( 5507): 01[ENC] generating IKE_SA_INIT request 0 [ SA KE No</div><div style="font-family: Consolas; font-size: medium; ">N(NATD_S_IP) N(NATD_D_IP) ]</div><div style="font-family: Consolas; font-size: medium; ">I/charon ( 5507): 01[NET] sending packet: from 192.168.24.17[57072] to</div><div style="font-family: Consolas; font-size: medium; ">192.168.24.2[500]</div><div style="font-family: Consolas; font-size: medium; ">I/charon ( 5507): 11[NET] received packet: from 192.168.24.2[500] to</div><div style="font-family: Consolas; font-size: medium; ">192.168.24.17[57072]</div><div style="font-family: Consolas; font-size: medium; ">I/charon ( 5507): 11[ENC] parsed IKE_SA_INIT response 0 [ SA KE No</div><div style="font-family: Consolas; font-size: medium; ">N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(MULT_AUTH) ]</div><div style="font-family: Consolas; font-size: medium; ">I/charon ( 5507): 11[IKE] faking NAT situation to enforce UDP encapsulation</div><div style="font-family: Consolas; font-size: medium; ">I/charon ( 5507): 11[IKE] received cert request for "C=US, ST=VA,</div><div style="font-family: Consolas; font-size: medium; ">L=RESTON, O=Metronome Software LLC, OU=Metronome,</div><div style="font-family: Consolas; font-size: medium; ">CN=metronome-software.com, <a href="mailto:E=admin@metronome-software.com">E=admin@metronome-software.com</a>"</div><div style="font-family: Consolas; font-size: medium; ">I/charon ( 5507): 11[IKE] sending cert request for "C=US, ST=VA,</div><div style="font-family: Consolas; font-size: medium; ">L=RESTON, O=Metronome Software LLC, CN=metronome-software.com"</div><div style="font-family: Consolas; font-size: medium; ">I/charon ( 5507): 11[IKE] sending cert request for "C=US, ST=VA,</div><div style="font-family: Consolas; font-size: medium; ">L=RESTON, O=Metronome Software LLC, OU=Metronome,</div><div style="font-family: Consolas; font-size: medium; ">CN=metronome-software.com, <a href="mailto:E=admin@metronome-software.com">E=admin@metronome-software.com</a>"</div><div style="font-family: Consolas; font-size: medium; ">I/charon ( 5507): 11[IKE] authentication of 'C=US, ST=VA, L=RESTON,</div><div style="font-family: Consolas; font-size: medium; ">O=Metronome Software LLC, OU=Metronome, CN=192.168.24.17,</div><div style="font-family: Consolas; font-size: medium; "><a href="mailto:E=admin@metronome-software.com">E=admin@metronome-software.com</a>' (myself) with RSA signature successful</div><div style="font-family: Consolas; font-size: medium; ">I/charon ( 5507): 11[IKE] sending end entity cert "C=US, ST=VA,</div><div style="font-family: Consolas; font-size: medium; ">L=RESTON, O=Metronome Software LLC, OU=Metronome, CN=192.168.24.17,</div><div style="font-family: Consolas; font-size: medium; "><a href="mailto:E=admin@metronome-software.com">E=admin@metronome-software.com</a>"</div><div style="font-family: Consolas; font-size: medium; ">I/charon ( 5507): 11[IKE] establishing CHILD_SA android</div><div style="font-family: Consolas; font-size: medium; ">I/keystore( 131): uid: 10049 action: n -> 1 state: 1 -> 1 retry: 4</div><div style="font-family: Consolas; font-size: medium; ">I/charon ( 5507): 11[ENC] generating IKE_AUTH request 1 [ IDi CERT</div><div style="font-family: Consolas; font-size: medium; ">N(INIT_CONTACT) CERTREQ AUTH CP(ADDR DNS) SA TSi TSr N(MOBIKE_SUP)</div><div style="font-family: Consolas; font-size: medium; ">N(NO_ADD_ADDR) N(MULT_AUTH) N(EAP_ONLY) ]</div><div style="font-family: Consolas; font-size: medium; ">I/charon ( 5507): 11[NET] sending packet: from 192.168.24.17[60821] to</div><div style="font-family: Consolas; font-size: medium; ">192.168.24.2[4500]</div><div style="font-family: Consolas; font-size: medium; ">I/charon ( 5507): 16[NET] received packet: from 192.168.24.2[4500] to</div><div style="font-family: Consolas; font-size: medium; ">192.168.24.17[60821]</div><div style="font-family: Consolas; font-size: medium; ">I/charon ( 5507): 16[ENC] parsed IKE_AUTH response 1 [ IDr CERT AUTH</div><div style="font-family: Consolas; font-size: medium; ">CP(ADDR) SA TSi TSr N(AUTH_LFT) N(MOBIKE_SUP) N(NO_ADD_ADDR) ]</div><div style="font-family: Consolas; font-size: medium; ">I/charon ( 5507): 16[IKE] received end entity cert "C=US, ST=VA,</div><div style="font-family: Consolas; font-size: medium; ">L=RESTON, O=Metronome Software LLC, OU=Metronome, CN=192.168.24.2,</div><div style="font-family: Consolas; font-size: medium; "><a href="mailto:E=admin@metronome-software.com">E=admin@metronome-software.com</a>"</div><div style="font-family: Consolas; font-size: medium; ">I/charon ( 5507): 16[CFG] using certificate "C=US, ST=VA, L=RESTON,</div><div style="font-family: Consolas; font-size: medium; ">O=Metronome Software LLC, OU=Metronome, CN=192.168.24.2,</div><div style="font-family: Consolas; font-size: medium; "><a href="mailto:E=admin@metronome-software.com">E=admin@metronome-software.com</a>"</div><div style="font-family: Consolas; font-size: medium; ">I/charon ( 5507): 16[CFG] using trusted ca certificate "C=US, ST=VA,</div><div style="font-family: Consolas; font-size: medium; ">L=RESTON, O=Metronome Software LLC, OU=Metronome,</div><div style="font-family: Consolas; font-size: medium; ">CN=metronome-software.com, <a href="mailto:E=admin@metronome-software.com">E=admin@metronome-software.com</a>"</div><div style="font-family: Consolas; font-size: medium; ">I/charon ( 5507): 16[CFG] reached self-signed root ca with a path</div><div style="font-family: Consolas; font-size: medium; ">length of 0</div><div style="font-family: Consolas; font-size: medium; ">I/charon ( 5507): 16[IKE] authentication of 'C=US, ST=VA, L=RESTON,</div><div style="font-family: Consolas; font-size: medium; ">O=Metronome Software LLC, OU=Metronome, CN=192.168.24.2,</div><div style="font-family: Consolas; font-size: medium; "><a href="mailto:E=admin@metronome-software.com">E=admin@metronome-software.com</a>' with RSA signature successful</div><div style="font-family: Consolas; font-size: medium; ">I/charon ( 5507): 16[CFG] constraint check failed: identity</div><div style="font-family: Consolas; font-size: medium; ">'192.168.24.2' required</div></div><div><div><div><p class="MsoNormal" style="font-family: Calibri, sans-serif; font-size: 14px; margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; "></p><p class="MsoNormal" style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; color: rgb(0, 0, 0); "><font class="Apple-style-span" face="Arial"><span class="Apple-style-span" style="font-size: 13px;"><br></span></font></p><p style="font-family: Calibri, sans-serif; font-size: 14px; "></p></div></div></div></div></div></body></html>