<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA1<br>
<br>
Hi Martin,<br>
<br>
I'm running OSX 10.8.5.<br>
I've installed the server certificate itself into keychain and now
that part seems to work.<br>
The connection still fails though, I'll paste the client side log
because I don't know exactly what it means.<br>
<br>
EAP method EAP_MSCHAPV2 succeeded, MSK established<br>
authentication of 'ctompers' (myself) with EAP<br>
generating IKE_AUTH request 5 [ AUTH ]<br>
sending packet: from 158.64.1.171[50209] to 158.64.1.53[4500] (92
bytes)<br>
received packet: from 158.64.1.53[4500] to 158.64.1.171[50209] (300
bytes)<br>
parsed IKE_AUTH response 5 [ AUTH CP(ADDR DNS DNS DNS6 U_DEF_DOMAIN
U_BANNER DNS6) SA TSi TSr ]<br>
authentication of 'vpn.restena.lu' with EAP successful<br>
IKE_SA Test[6] established between
158.64.1.171[ctompers]...158.64.1.53[vpn.restena.lu]<br>
scheduling rekeying in 35450s<br>
maximum IKE_SA lifetime 36050s<br>
installing 158.64.1.25 as DNS server<br>
installing 158.64.1.14 as DNS server<br>
handling INTERNAL_IP6_DNS attribute failed<br>
handling UNITY_DEF_DOMAIN attribute failed<br>
handling UNITY_BANNER attribute failed<br>
handling INTERNAL_IP6_DNS attribute failed<br>
installing new virtual IP 158.64.122.140<br>
created TUN device: utun1<br>
virtual IP 158.64.122.140 did not appear on utun1<br>
installing virtual IP 158.64.122.140 failed<br>
no acceptable traffic selectors found<br>
closing IKE_SA due CHILD_SA setup failure<br>
sending DELETE for ESP CHILD_SA with SPI 31576d8e<br>
generating INFORMATIONAL request 6 [ D ]<br>
sending packet: from 158.64.1.171[50209] to 158.64.1.53[4500] (76
bytes)<br>
received packet: from 158.64.1.53[4500] to 158.64.1.171[50209] (76
bytes)<br>
parsed INFORMATIONAL response 6 [ D ]<br>
deleting IKE_SA Test[6] between
158.64.1.171[ctompers]...158.64.1.53[vpn.restena.lu]<br>
sending DELETE for IKE_SA Test[6]<br>
generating INFORMATIONAL request 7 [ D ]<br>
sending packet: from 158.64.1.171[50209] to 158.64.1.53[4500] (76
bytes)<br>
received packet: from 158.64.1.53[4500] to 158.64.1.171[50209] (76
bytes)<br>
parsed INFORMATIONAL response 7 [ ]<br>
IKE_SA deleted<br>
<br>
regards,<br>
Claude<br>
<br>
<br>
On 9/18/13 10:58 AM, Martin Willi wrote:<br>
<span style="white-space: pre;">> Hi Claude,<br>
><br>
>> I have some keychain problems. I have a CA certificate
installed in the<br>
>> system store and marked it as "Always Trust", but I still
get a server<br>
>> authentication failure.<br>
><br>
> Both installing end entity and CA certificates to the
Keychain as<br>
> "Always Trust" works here on 10.8. Some notes:<br>
><br>
> * Certificates should go to the "System" keychain<br>
> * CA certificates must have the CA basicConstraint<br>
><br>
> What version of OS X are you running?<br>
><br>
> You might also try to tweak your syslogger to get the daemon
startup log<br>
> and check if there is something suspicious. To do so, for
example add:<br>
><br>
> daemon.info /var/log/daemon.log<br>
><br>
> to /etc/syslog.conf and restart the syslogger with<br>
><br>
> launchctl unload
/System/Library/LaunchDaemons/com.apple.syslogd.plist <br>
> launchctl load
/System/Library/LaunchDaemons/com.apple.syslogd.plist<br>
><br>
> During startup or any changes to the Keychain, you should see
something<br>
> like:<br>
><br>
> loaded 209 certificates from /System/Library/Keychains/...<br>
> loaded 12 certificates from /Library/Keychains/...<br>
><br>
> Regards<br>
> Martin<br>
></span><br>
<br>
- -- <br>
Claude Tompers<br>
Ingénieur réseau et système<br>
Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale
et de la Recherche<br>
6, rue Richard Coudenhove-Kalergi<br>
L-1359 Luxembourg<br>
<br>
Tel: +352 424409 1<br>
Fax: +352 422473<br>
-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v1.4.9 (Darwin)<br>
Comment: Using GnuPG with Thunderbird - <a class="moz-txt-link-freetext" href="http://www.enigmail.net/">http://www.enigmail.net/</a><br>
<br>
iEYEARECAAYFAlI5leIACgkQ3yoZ+Bpc/J4LtgCgx2oIxluHnRJr1qDT85IPs9ls<br>
7XsAn2gkfqK7fUSe5HIeFs+uDNgdwr0H<br>
=NgOE<br>
-----END PGP SIGNATURE-----<br>
<br>
</body>
</html>