<div dir="ltr">Hi Andreas,<div><br></div><div>I am putting both RootCA & SubCA locally in /etc/ipsec.d/cacerts but still its giving the same error..</div><div>Even when I do "ipsec listall" its only showing the RootCA..</div>
<div><br></div><div>Regards,</div><div>Rashid<br><br><div class="gmail_quote">On Sat, Mar 9, 2013 at 8:03 PM, Andreas Steffen <span dir="ltr"><<a href="mailto:andreas.steffen@strongswan.org" target="_blank">andreas.steffen@strongswan.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Rashid,<br>
<br>
an endpoint must store either the SubCA certificate locally in<br>
/etc/ipsec.d/cacerts or must receive it from the peer together<br>
with the user certificate in an IKEv2 CERT payload.<br>
<br>
Regards<br>
<br>
Andreas<br>
<br>
On 03/09/2013 05:00 PM, Mohammed Rashid wrote:<br>
> *Hi All,<br>
<div class="im">><br>
> I am using strongswan 5.0.2. I am using the following configuration with<br>
> host-host transport mode.<br>
> It was working fine when I was using the certificates directly from RootCA. But when I generated certificates from SUBCA, ipsec starts giving errors which I mentioned below..<br>
</div>> *<br>
> /Mar 9 15:22:13 charon: 15[CFG] received stroke: initiate 'user4'<br>
<div class="im">><br>
> Mar 9 15:22:13 charon: 10[IKE] initiating IKE_SA user4[5] to 192.168.20.126<br>
> Mar 9 15:22:13 charon: 10[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]<br>
> Mar 9 15:22:13 charon: 10[NET] sending packet: from 192.168.20.112[500] to 192.168.20.126[500] (692 bytes)<br>
><br>
> Mar 9 15:22:13 charon: 09[NET] received packet: from 192.168.20.126[500] to 192.168.20.112[500] (432 bytes)<br>
> Mar 9 15:22:13 charon: 09[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]<br>
> Mar 9 15:22:13 charon: 09[IKE] authentication of 'user5' (myself) with RSA signature successful<br>
><br>
> Mar 9 15:22:13 charon: 09[IKE] establishing CHILD_SA user4<br>
> Mar 9 15:22:13 charon: 09[ENC] generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr AUTH N(USE_TRANSP) SA TSi TSr N(EAP_ONLY) ]<br>
> Mar 9 15:22:13 charon: 09[NET] sending packet: from 192.168.20.112[500] to 192.168.20.126[500] (684 bytes)<br>
><br>
> Mar 9 15:22:13 charon: 07[NET] received packet: from 192.168.20.126[500] to 192.168.20.112[500] (76 bytes)<br>
</div>> *Mar 9 15:22:13 charon: 07[ENC] parsed IKE_AUTH response 1 [ N(AUTH_FAILED) ]<br>
> Mar 9 15:22:13 charon: 07[IKE] received AUTHENTICATION_FAILED notify error*<br>
<div class="im">><br>
><br>
><br>
> Mar 9 17:28:43 charon: 15[NET] received packet: from 192.168.20.112[500] to 192.168.20.126[500] (692 bytes)<br>
> Mar 9 17:28:43 charon: 15[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]<br>
><br>
> Mar 9 17:28:43 charon: 15[IKE] 192.168.20.112 is initiating an IKE_SA<br>
> Mar 9 17:28:43 charon: 15[IKE] sending cert request for "CN=...."<br>
> Mar 9 17:28:43 charon: 15[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ ]<br>
><br>
> Mar 9 17:28:43 charon: 15[NET] sending packet: from 192.168.20.126[500] to 192.168.20.112[500] (457 bytes)<br>
> Mar 9 17:28:43 charon: 09[NET] received packet: from 192.168.20.112[500] to 192.168.20.126[500] (1548 bytes)<br>
><br>
> Mar 9 17:28:43 charon: 09[ENC] parsed IKE_AUTH request 1 [ IDi CERT N(INIT_CONTACT) CERTREQ IDr AUTH N(USE_TRANSP) SA TSi TSr N(EAP_ONLY) ]<br>
> Mar 9 17:28:43 charon: 09[IKE] received cert request for "CN...."<br>
><br>
> Mar 9 17:28:43 charon: 09[IKE] received end entity cert "CN=user5..."<br>
> Mar 9 17:28:43 charon: 09[CFG] looking for peer configs matching 192.168.20.126[user4]...192.168.20.112[user5]<br>
> Mar 9 17:28:43 charon: 09[CFG] selected peer config 'user5'<br>
><br>
> Mar 9 17:28:43 charon: 09[CFG] using certificate "CN=user5..."<br>
</div>> *Mar 9 17:28:43 charon: 09[CFG] no issuer certificate found for "CN=user5...."<br>
> Mar 9 17:28:43 charon: 09[IKE] no trusted RSA public key found for 'user5'*<br>
<div class="im">><br>
> Mar 9 17:28:43 charon: 09[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]<br>
</div>> Mar 9 17:28:43 charon: 09[NET] sending packet: from 192.168.20.126[500] to 192.168.20.112[500] (76 bytes)/<br>
><br>
> Regards,<br>
> Rashid<br>
<br>
======================================================================<br>
Andreas Steffen <a href="mailto:andreas.steffen@strongswan.org">andreas.steffen@strongswan.org</a><br>
strongSwan - the Linux VPN Solution! <a href="http://www.strongswan.org" target="_blank">www.strongswan.org</a><br>
Institute for Internet Technologies and Applications<br>
University of Applied Sciences Rapperswil<br>
CH-8640 Rapperswil (Switzerland)<br>
===========================================================[ITA-HSR]==<br>
<br>
</blockquote></div><br></div></div>