<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style id="owaParaStyle" type="text/css">P {margin-top:0;margin-bottom:0;}</style>
</head>
<body ocsi="0" fpstyle="1">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 13px;">
<div style=""> </div>
<br>
ECDSA failures with Strongswan 5.0.2 and openssl 1.0.1e-fips<br>
<br>
Apr 2 14:59:33 00[LIB] building CRED_PRIVATE_KEY - ECDSA failed, tried 2 builders<br>
Apr 2 14:59:33 00[CFG] loading private key from '/etc/strongswan/ipsec.d/private/outerKey.pem' failed<br>
<br>
I'm also seeing these messages related to the private key that was generated on the server:<br>
Apr 2 15:18:16 00[ASN] L1 - encryptionAlgorithm:<br>
Apr 2 15:18:16 00[ASN] L2 - algorithmIdentifier: ASN1 tag 0x30 expected, but is 0x02<br>
<br>
I'm not sure where the source of failure is, the build, cert/key cretion, or stongswan configuration.<br>
<br>
These are the configure parameters used when building Strongswan:<br>
./configure --enable-openssl --prefix=/usr --sysconfdir=/etc<br>
make<br>
make install<br>
<br>
<br>
Here are the commands used to generate the keys and cert request:<br>
# ipsec pki --gen --type ecdsa --size 384 > ecdsaKey.pem<br>
# ipsec pki --req --in ecdsaKey.pem --type ecdsa --dn "C=US,ST=Texas,L=City,O=Company,OU=Engineering,CN=10.50.102.44" --digest sha384 –outform pem > ecdsaReq.pem<br>
<br>
Here are the modules loaded in strongswan.conf<br>
load = openssl fips-prf charon aes des sha1 sha2 md5 random nonce x509 pubkey pkcs1 pkcs8 pgp pem gmp xcbc hmac kernel-netlink socket-default stroke updown<br>
<br>
Below is the full strongswan restart logs:<br>
<br>
Thanks,<br>
Scot<br>
<br>
Apr 2 15:18:13 00[DMN] signal of type SIGINT received. Shutting down<br>
Apr 2 15:18:13 00[MGR] going to destroy IKE_SA manager and all managed IKE_SA's<br>
Apr 2 15:18:13 00[MGR] set driveout flags for all stored IKE_SA's<br>
Apr 2 15:18:13 00[MGR] wait for all threads to leave IKE_SA's<br>
Apr 2 15:18:13 00[MGR] delete all IKE_SA's<br>
Apr 2 15:18:13 00[MGR] destroy all entries<br>
Apr 2 15:18:13 03[JOB] terminated worker thread 03<br>
Apr 2 15:18:13 06[JOB] terminated worker thread 06<br>
Apr 2 15:18:13 01[JOB] terminated worker thread 01<br>
Apr 2 15:18:13 05[JOB] terminated worker thread 05<br>
Apr 2 15:18:13 02[JOB] terminated worker thread 02<br>
Apr 2 15:18:13 04[JOB] terminated worker thread 04<br>
Apr 2 15:18:13 07[JOB] terminated worker thread 07<br>
tail: /var/log/charon.log: file truncated<br>
Apr 2 15:18:16 00[DMN] Starting IKE charon daemon (strongSwan 5.0.0, Linux 2.6.32-358.el6.x86_64, x86_64)<br>
Apr 2 15:18:16 00[LIB] plugin 'openssl': loaded successfully<br>
Apr 2 15:18:16 00[LIB] plugin 'fips-prf': loaded successfully<br>
Apr 2 15:18:16 00[LIB] plugin 'aes': loaded successfully<br>
Apr 2 15:18:16 00[LIB] plugin 'des': loaded successfully<br>
Apr 2 15:18:16 00[LIB] plugin 'sha1': loaded successfully<br>
Apr 2 15:18:16 00[LIB] plugin 'sha2': loaded successfully<br>
Apr 2 15:18:16 00[LIB] plugin 'md5': loaded successfully<br>
Apr 2 15:18:16 00[LIB] plugin 'random': loaded successfully<br>
Apr 2 15:18:16 00[LIB] plugin 'nonce': loaded successfully<br>
Apr 2 15:18:16 00[LIB] plugin 'x509': loaded successfully<br>
Apr 2 15:18:16 00[LIB] plugin 'pubkey': loaded successfully<br>
Apr 2 15:18:16 00[LIB] plugin 'pkcs1': loaded successfully<br>
Apr 2 15:18:16 00[LIB] plugin 'pkcs8': loaded successfully<br>
Apr 2 15:18:16 00[LIB] plugin 'pgp': loaded successfully<br>
Apr 2 15:18:16 00[LIB] plugin 'pem': loaded successfully<br>
Apr 2 15:18:16 00[LIB] plugin 'gmp': loaded successfully<br>
Apr 2 15:18:16 00[LIB] plugin 'xcbc': loaded successfully<br>
Apr 2 15:18:16 00[LIB] plugin 'hmac': loaded successfully<br>
Apr 2 15:18:16 00[LIB] plugin 'kernel-netlink': loaded successfully<br>
Apr 2 15:18:16 00[KNL] detected Linux 2.6.32, no support for RTA_PREFSRC for IPv6 routes<br>
Apr 2 15:18:16 00[KNL] listening on interfaces:<br>
Apr 2 15:18:16 00[KNL] eth0<br>
Apr 2 15:18:16 00[KNL] 10.50.102.44<br>
Apr 2 15:18:16 00[KNL] fe80::20c:29ff:fe7b:94b9<br>
Apr 2 15:18:16 00[KNL] eth1<br>
Apr 2 15:18:16 00[KNL] fe80::20c:29ff:fe7b:94c3<br>
Apr 2 15:18:16 00[LIB] plugin 'socket-default': loaded successfully<br>
Apr 2 15:18:16 00[LIB] plugin 'stroke': loaded successfully<br>
Apr 2 15:18:16 00[LIB] plugin 'updown': loaded successfully<br>
Apr 2 15:18:16 00[CFG] loading ca certificates from '/etc/strongswan/ipsec.d/cacerts'<br>
Apr 2 15:18:16 00[ASN] file content is not binary ASN.1<br>
Apr 2 15:18:16 00[ASN] -----BEGIN CERTIFICATE-----<br>
Apr 2 15:18:16 00[ASN] -----END CERTIFICATE-----<br>
Apr 2 15:18:16 00[LIB] OpenSSL X.509 parsing failed<br>
Apr 2 15:18:16 00[ASN] L0 - x509:<br>
Apr 2 15:18:16 00[ASN] L1 - tbsCertificate:<br>
Apr 2 15:18:16 00[ASN] L2 - DEFAULT v1:<br>
Apr 2 15:18:16 00[ASN] X.509v1<br>
Apr 2 15:18:16 00[ASN] L2 - serialNumber:<br>
Apr 2 15:18:16 00[ASN] L2 - signature:<br>
Apr 2 15:18:16 00[ASN] L3 - algorithmIdentifier:<br>
Apr 2 15:18:16 00[ASN] L4 - algorithm:<br>
Apr 2 15:18:16 00[ASN] 'ecdsa-with-SHA384'<br>
Apr 2 15:18:16 00[ASN] L2 - issuer:<br>
Apr 2 15:18:16 00[ASN] 'C=US, ST=Texas, L=City, O=Company, OU=Engineering, CN=ca.company.com'<br>
Apr 2 15:18:16 00[ASN] L2 - validity:<br>
Apr 2 15:18:16 00[ASN] L3 - notBefore:<br>
Apr 2 15:18:16 00[ASN] L4 - utcTime:<br>
Apr 2 15:18:16 00[ASN] 'Mar 29 12:21:59 UTC 2013'<br>
Apr 2 15:18:16 00[ASN] L3 - notAfter:<br>
Apr 2 15:18:16 00[ASN] L4 - utcTime:<br>
Apr 2 15:18:16 00[ASN] 'Mar 27 12:21:59 UTC 2023'<br>
Apr 2 15:18:16 00[ASN] L2 - subject:<br>
Apr 2 15:18:16 00[ASN] 'C=US, ST=Texas, L=City, O=Company, OU=Engineering, CN=ca.company.com'<br>
Apr 2 15:18:16 00[ASN] L2 - subjectPublicKeyInfo:<br>
Apr 2 15:18:16 00[ASN] -- > --<br>
Apr 2 15:18:16 00[ASN] L0 - subjectPublicKeyInfo:<br>
Apr 2 15:18:16 00[ASN] L1 - algorithm:<br>
Apr 2 15:18:16 00[ASN] L2 - algorithmIdentifier:<br>
Apr 2 15:18:16 00[ASN] L3 - algorithm:<br>
Apr 2 15:18:16 00[ASN] 'id-ecPublicKey'<br>
Apr 2 15:18:16 00[ASN] L3 - parameters:<br>
Apr 2 15:18:16 00[ASN] -- < --<br>
Apr 2 15:18:16 00[LIB] building CRED_CERTIFICATE - X509 failed, tried 4 builders<br>
Apr 2 15:18:16 00[CFG] loading ca certificate from '/etc/strongswan/ipsec.d/cacerts/ca_cert.pem' failed<br>
Apr 2 15:18:16 00[CFG] loading aa certificates from '/etc/strongswan/ipsec.d/aacerts'<br>
Apr 2 15:18:16 00[LIB] opening directory '/etc/strongswan/ipsec.d/aacerts' failed: No such file or directory<br>
Apr 2 15:18:16 00[CFG] reading directory failed<br>
Apr 2 15:18:16 00[CFG] loading ocsp signer certificates from '/etc/strongswan/ipsec.d/ocspcerts'<br>
Apr 2 15:18:16 00[LIB] opening directory '/etc/strongswan/ipsec.d/ocspcerts' failed: No such file or directory<br>
Apr 2 15:18:16 00[CFG] reading directory failed<br>
Apr 2 15:18:16 00[CFG] loading attribute certificates from '/etc/strongswan/ipsec.d/acerts'<br>
Apr 2 15:18:16 00[LIB] opening directory '/etc/strongswan/ipsec.d/acerts' failed: No such file or directory<br>
Apr 2 15:18:16 00[CFG] reading directory failed<br>
Apr 2 15:18:16 00[CFG] loading crls from '/etc/strongswan/ipsec.d/crls'<br>
Apr 2 15:18:16 00[CFG] loading secrets from '/etc/strongswan/ipsec.secrets'<br>
Apr 2 15:18:16 00[ASN] file content is not binary ASN.1<br>
Apr 2 15:18:16 00[ASN] -----BEGIN EC PRIVATE KEY-----<br>
Apr 2 15:18:16 00[ASN] -----END EC PRIVATE KEY-----<br>
Apr 2 15:18:16 00[ASN] L0 - encryptedPrivateKeyInfo:<br>
Apr 2 15:18:16 00[ASN] L1 - encryptionAlgorithm:<br>
Apr 2 15:18:16 00[ASN] L2 - algorithmIdentifier: ASN1 tag 0x30 expected, but is 0x02<br>
Apr 2 15:18:16 00[ASN] L0 - privateKeyInfo:<br>
Apr 2 15:18:16 00[ASN] L1 - version:<br>
Apr 2 15:18:16 00[ASN] L1 - privateKeyAlgorithm:<br>
Apr 2 15:18:16 00[ASN] L2 - algorithmIdentifier: ASN1 tag 0x30 expected, but is 0x04<br>
Apr 2 15:18:16 00[LIB] building CRED_PRIVATE_KEY - ECDSA failed, tried 2 builders<br>
Apr 2 15:18:16 00[CFG] loading private key from '/etc/strongswan/ipsec.d/private/outerKey.pem' failed<br>
Apr 2 15:18:16 00[LIB] feature PRIVKEY:DSA in 'pem' plugin has unsatisfied dependency: PRIVKEY:DSA<br>
Apr 2 15:18:16 00[LIB] feature PUBKEY:ECDSA in 'pem' plugin has unsatisfied dependency: PUBKEY:ECDSA<br>
Apr 2 15:18:16 00[LIB] feature PUBKEY:DSA in 'pem' plugin has unsatisfied dependency: PUBKEY:DSA<br>
Apr 2 15:18:16 00[LIB] feature CERT_DECODE:X509_OCSP_REQUEST in 'pem' plugin has unsatisfied dependency: CERT_DECODE:X509_OCSP_REQUEST<br>
Apr 2 15:18:16 00[DMN] loaded plugins: charon openssl fips-prf aes des sha1 sha2 md5 random nonce x509 pubkey pkcs1 pkcs8 pgp pem gmp xcbc hmac kernel-netlink socket-default stroke updown<br>
Apr 2 15:18:16 00[JOB] spawning 16 worker threads<br>
Apr 2 15:18:16 01[LIB] created thread 01 [8914]<br>
Apr 2 15:18:16 02[LIB] created thread 02 [8915]<br>
Apr 2 15:18:16 02[JOB] started worker thread 02<br>
Apr 2 15:18:16 01[JOB] started worker thread 01<br>
Apr 2 15:18:16 03[LIB] created thread 03 [8916]<br>
Apr 2 15:18:16 03[JOB] started worker thread 03<br>
Apr 2 15:18:16 05[LIB] created thread 05 [8918]<br>
Apr 2 15:18:16 07[LIB] created thread 07 [8920]<br>
Apr 2 15:18:16 06[LIB] created thread 06 [8919]<br>
Apr 2 15:18:16 08[LIB] created thread 08 [8921]<br>
Apr 2 15:18:16 11[LIB] created thread 11 [8924]<br>
Apr 2 15:18:16 07[JOB] started worker thread 07<br>
Apr 2 15:18:16 06[JOB] started worker thread 06<br>
Apr 2 15:18:16 05[JOB] started worker thread 05<br>
Apr 2 15:18:16 10[LIB] created thread 10 [8923]<br>
Apr 2 15:18:16 10[JOB] started worker thread 10<br>
Apr 2 15:18:16 04[LIB] created thread 04 [8917]<br>
Apr 2 15:18:16 04[JOB] started worker thread 04<br>
Apr 2 15:18:16 09[LIB] created thread 09 [8922]<br>
Apr 2 15:18:16 09[JOB] started worker thread 09<br>
Apr 2 15:18:16 11[JOB] started worker thread 11<br>
Apr 2 15:18:16 15[LIB] created thread 15 [8928]<br>
Apr 2 15:18:16 15[JOB] started worker thread 15<br>
Apr 2 15:18:16 16[LIB] created thread 16 [8929]<br>
Apr 2 15:18:16 16[JOB] started worker thread 16<br>
Apr 2 15:18:16 14[LIB] created thread 14 [8927]<br>
Apr 2 15:18:16 14[JOB] started worker thread 14<br>
Apr 2 15:18:16 02[JOB] no events, waiting<br>
Apr 2 15:18:16 05[NET] waiting for data on sockets<br>
Apr 2 15:18:16 08[JOB] started worker thread 08<br>
Apr 2 15:18:16 13[LIB] created thread 13 [8926]<br>
Apr 2 15:18:16 12[LIB] created thread 12 [8925]<br>
Apr 2 15:18:16 12[JOB] started worker thread 12<br>
Apr 2 15:18:16 13[JOB] started worker thread 13<br>
Apr 2 15:18:16 04[CFG] received stroke: add connection 'device-outer-tunnel'<br>
Apr 2 15:18:16 04[CFG] conn device-outer-tunnel<br>
Apr 2 15:18:16 04[CFG] left=10.50.102.17<br>
Apr 2 15:18:16 04[CFG] leftsubnet=10.50.102.16/28<br>
Apr 2 15:18:16 04[CFG] leftsourceip=(null)<br>
Apr 2 15:18:16 04[CFG] leftauth=pubkey<br>
Apr 2 15:18:16 04[CFG] leftauth2=(null)<br>
Apr 2 15:18:16 04[CFG] leftid=(null)<br>
Apr 2 15:18:16 04[CFG] leftid2=(null)<br>
Apr 2 15:18:16 04[CFG] leftrsakey=(null)<br>
Apr 2 15:18:16 04[CFG] leftcert=ecdsaReq_cert.pem<br>
Apr 2 15:18:16 04[CFG] leftcert2=(null)<br>
Apr 2 15:18:16 04[CFG] leftca=(null)<br>
Apr 2 15:18:16 04[CFG] leftca2=(null)<br>
Apr 2 15:18:16 04[CFG] leftgroups=(null)<br>
Apr 2 15:18:16 04[CFG] leftupdown=(null)<br>
Apr 2 15:18:16 04[CFG] right=%any<br>
Apr 2 15:18:16 04[CFG] rightsubnet=(null)<br>
Apr 2 15:18:16 04[CFG] rightsourceip=(null)<br>
Apr 2 15:18:16 04[CFG] rightauth=pubkey<br>
Apr 2 15:18:16 04[CFG] rightauth2=(null)<br>
Apr 2 15:18:16 04[CFG] rightid=C=US, ST=Texas, L=City, O=Company, OU=Engineering, CN=ca.company.com<br>
Apr 2 15:18:16 04[CFG] rightid2=(null)<br>
Apr 2 15:18:16 04[CFG] rightrsakey=(null)<br>
Apr 2 15:18:16 04[CFG] rightcert=(null)<br>
Apr 2 15:18:16 04[CFG] rightcert2=(null)<br>
Apr 2 15:18:16 04[CFG] rightca=(null)<br>
Apr 2 15:18:16 04[CFG] rightca2=(null)<br>
Apr 2 15:18:16 04[CFG] rightgroups=(null)<br>
Apr 2 15:18:16 04[CFG] rightupdown=(null)<br>
Apr 2 15:18:16 04[CFG] eap_identity=(null)<br>
Apr 2 15:18:16 04[CFG] aaa_identity=(null)<br>
Apr 2 15:18:16 04[CFG] xauth_identity=(null)<br>
Apr 2 15:18:16 04[CFG] ike=aes128-sha1-modp2048,3des-sha1-modp1536<br>
Apr 2 15:18:16 04[CFG] esp=aes128-sha1-modp2048,3des-sha1-modp1536<br>
Apr 2 15:18:16 04[CFG] dpddelay=30<br>
Apr 2 15:18:16 04[CFG] dpdtimeout=150<br>
Apr 2 15:18:16 04[CFG] dpdaction=0<br>
Apr 2 15:18:16 04[CFG] closeaction=0<br>
Apr 2 15:18:16 04[CFG] mediation=no<br>
Apr 2 15:18:16 04[CFG] mediated_by=(null)<br>
Apr 2 15:18:16 04[CFG] me_peerid=(null)<br>
Apr 2 15:18:16 04[CFG] keyexchange=ikev2<br>
Apr 2 15:18:16 04[KNL] getting interface name for %any<br>
Apr 2 15:18:16 04[KNL] %any is not a local address<br>
Apr 2 15:18:16 04[KNL] getting interface name for 10.50.102.17<br>
Apr 2 15:18:16 04[KNL] 10.50.102.17 is not a local address<br>
Apr 2 15:18:16 04[CFG] left nor right host is our side, assuming left=local<br>
Apr 2 15:18:16 04[ASN] file content is not binary ASN.1<br>
Apr 2 15:18:16 04[ASN] -----BEGIN CERTIFICATE-----<br>
Apr 2 15:18:16 04[ASN] -----END CERTIFICATE-----<br>
Apr 2 15:18:16 04[LIB] OpenSSL X.509 parsing failed<br>
Apr 2 15:18:16 04[ASN] L0 - x509:<br>
Apr 2 15:18:16 04[ASN] L1 - tbsCertificate:<br>
Apr 2 15:18:16 04[ASN] L2 - DEFAULT v1:<br>
Apr 2 15:18:16 04[ASN] X.509v1<br>
Apr 2 15:18:16 04[ASN] L2 - serialNumber:<br>
Apr 2 15:18:16 04[ASN] L2 - signature:<br>
Apr 2 15:18:16 04[ASN] L3 - algorithmIdentifier:<br>
Apr 2 15:18:16 04[ASN] L4 - algorithm:<br>
Apr 2 15:18:16 04[ASN] 'ecdsa-with-SHA384'<br>
Apr 2 15:18:16 04[ASN] L2 - issuer:<br>
Apr 2 15:18:16 04[ASN] 'C=US, ST=Texas, L=City, O=Company, OU=Engineering, CN=ca.company.com'<br>
Apr 2 15:18:16 04[ASN] L2 - validity:<br>
Apr 2 15:18:16 04[ASN] L3 - notBefore:<br>
Apr 2 15:18:16 04[ASN] L4 - utcTime:<br>
Apr 2 15:18:16 04[ASN] 'Apr 02 14:30:33 UTC 2013'<br>
Apr 2 15:18:16 04[ASN] L3 - notAfter:<br>
Apr 2 15:18:16 04[ASN] L4 - utcTime:<br>
Apr 2 15:18:16 04[ASN] 'Apr 02 14:30:33 UTC 2014'<br>
Apr 2 15:18:16 04[ASN] L2 - subject:<br>
Apr 2 15:18:16 04[ASN] 'C=US, ST=Texas, L=City, O=Company, OU=Engineering, CN=10.50.102.44'<br>
Apr 2 15:18:16 04[ASN] L2 - subjectPublicKeyInfo:<br>
Apr 2 15:18:16 04[ASN] -- > --<br>
Apr 2 15:18:16 04[ASN] L0 - subjectPublicKeyInfo:<br>
Apr 2 15:18:16 04[ASN] L1 - algorithm:<br>
Apr 2 15:18:16 04[ASN] L2 - algorithmIdentifier:<br>
Apr 2 15:18:16 04[ASN] L3 - algorithm:<br>
Apr 2 15:18:16 04[ASN] 'id-ecPublicKey'<br>
Apr 2 15:18:16 04[ASN] L3 - parameters:<br>
Apr 2 15:18:16 04[ASN] -- < --<br>
Apr 2 15:18:16 04[LIB] building CRED_CERTIFICATE - ANY failed, tried 1 builders<br>
Apr 2 15:18:16 04[CFG] loading certificate from 'ecdsaReq_cert.pem' failed<br>
Apr 2 15:18:16 04[CFG] added configuration 'device-outer-tunnel'<br>
<br>
</div>
</body>
</html>