<div dir="ltr"><div><div><div>Hi Andreas,<br><br>I think it is not loaded. <br><br>On 10.206.1.11<br><br>[root@localhost ~]# ipsec listcacerts<br><br>List of X.509 CA Certificates:<br><br> subject: "CN=DaRoot"<br>
issuer: "CN=DaRoot"<br> serial: c9:95:0a:00:41:c4:d8:25<br> validity: not before Mar 03 18:10:17 2014, ok<br> not after Apr 02 18:10:17 2014, ok (expires in 28 days)<br> pubkey: RSA 2048 bits<br>
keyid: be:25:1a:4a:e6:f8:44:c4:fe:32:a8:d4:7c:9d:75:42:7d:51:19:0f<br> subjkey: c3:59:68:a5:73:e8:b8:76:45:06:3b:c8:a4:62:b3:06:61:7e:9a:c0<br> authkey: c3:59:68:a5:73:e8:b8:76:45:06:3b:c8:a4:62:b3:06:61:7e:9a:c0<br>
<br><br></div>on 10.206.1.10<br>[root@localhost ~]# ipsec listcacerts<br><br>List of X.509 CA Certificates:<br><br> subject: "CN=DaRoot"<br> issuer: "CN=DaRoot"<br> serial: c9:95:0a:00:41:c4:d8:25<br>
validity: not before Mar 03 18:10:17 2014, ok<br> not after Apr 02 18:10:17 2014, ok (expires in 28 days)<br> pubkey: RSA 2048 bits<br> keyid: be:25:1a:4a:e6:f8:44:c4:fe:32:a8:d4:7c:9d:75:42:7d:51:19:0f<br>
subjkey: c3:59:68:a5:73:e8:b8:76:45:06:3b:c8:a4:62:b3:06:61:7e:9a:c0<br> authkey: c3:59:68:a5:73:e8:b8:76:45:06:3b:c8:a4:62:b3:06:61:7e:9a:c0<br><br></div>Regards,<br></div>Sriram.<br></div><div class="gmail_extra">
<br><br><div class="gmail_quote">On Tue, Mar 4, 2014 at 6:49 PM, Andreas Steffen <span dir="ltr"><<a href="mailto:andreas.steffen@strongswan.org" target="_blank">andreas.steffen@strongswan.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Sriram, could you post the output of the command<br>
<br>
ipsec listcacerts<br>
<br>
both on 10.206.1.10 and 10.206.1.11. This shows if the intermediate<br>
CA certificates have been successfully loaded.<br>
<br>
Regards<br>
<br>
Andreas<div class=""><br>
<br>
On <a href="tel:04.03.2014%2012" value="+49403201412" target="_blank">04.03.2014 12</a>:45, Sriram wrote:<br>
</div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="">
Hi Everyone,<br>
<br>
I have host –to-host ipsec setup between 2 ips 10.206.1.10 and 10.206.1.11<br>
<br>
Tunnel is established using certificates. Tunnel is established<br>
properly, when the certificates are generated using rootca.<br>
<br>
But when the certificates are generated using intermediate CA’s, tunnel<br>
is not getting established.<br>
<br>
In 10.206.1.10<br>
<br>
Under /etc/ipsec.d/cacerts/ I have copied ca.crt(root ca),<br></div>
*ca-int.crt(Intermediate ca)*<div class=""><br>
<br>
In /etc/ipsec.d/certs/ I have copied end entity cert issued by ca-int.crt<br>
<br>
In 10.206.1.11<br>
<br>
Under /etc/ipsec.d/cacerts/ I have copied ca.crt(root ca),<br></div>
*ca-int1.crt(Intermediate ca)*<div class=""><br>
<br>
In /etc/ipsec.d/certs/ I have copied end entity cert issued by ca-int1.crt<br>
<br>
I am getting below errors<br>
<br></div>
Mar3 19:34:45 localhost charon: 06[ENC] parsed IKE_AUTH request 1 [ IDi<div class=""><br>
CERT N(INIT_CONTACT) CERTREQ IDr AUTH CPRQ(ADDR) SA TSi TSr N(MULT_AUTH)<br>
N(EAP_ONLY) ]<br>
<br></div>
Mar3 19:34:45 localhost charon: 06[IKE] received cert request for<br>
"CN=DaRoot"<br>
<br>
Mar3 19:34:45 localhost charon: 06[IKE] received end entity cert<br>
"CN=1234abcd"<br>
<br>
Mar3 19:34:45 localhost charon: 06[CFG] looking for peer configs<div class=""><br>
matching 10.206.1.11[CN=12345abcde]...<u></u>10.206.1.10[CN=1234abcd]<br>
<br></div>
Mar3 19:34:45 localhost charon: 06[CFG] peer config match local: 20<div class=""><br>
(ID_DER_ASN1_DN -><br>
30:15:31:13:30:11:06:03:55:04:<u></u>03:13:0a:31:32:33:34:35:61:62:<u></u>63:64:65)<br>
<br></div>
Mar3 19:34:45 localhost charon: 06[CFG] peer config match remote: 20<div class=""><br>
(ID_DER_ASN1_DN -><br>
30:13:31:11:30:0f:06:03:55:04:<u></u>03:13:08:31:32:33:34:61:62:63:<u></u>64)<br>
<br></div>
Mar3 19:34:45 localhost charon: 06[CFG] ike config match: 3100<br>
(10.206.1.11 10.206.1.10 IKEv2)<br>
<br>
Mar3 19:34:45 localhost charon: 06[CFG]candidate "home1", match:<br>
20/20/3100 (me/other/ike)<br>
<br>
Mar3 19:34:45 localhost charon: 06[CFG] selected peer config 'home1'<br>
<br>
Mar3 19:34:45 localhost charon: 06[IKE] IDx' => 25 bytes @ 0xb4d82fe0<br>
<br>
Mar3 19:34:45 localhost charon: 06[IKE]0: 09 00 00 00 30 13 31 11 30 0F<div class=""><br>
<a href="tel:06%2003%2055%2004%2003%2013....0.1.0" value="+4960355040313010" target="_blank">06 03 55 04 03 13....0.1.0</a>...U...<br>
<br></div>
Mar3 19:34:45 localhost charon: 06[IKE]16: 08 31 32 33 34 61 62 63<br>
64.1234abcd<br>
<br>
Mar3 19:34:45 localhost charon: 06[IKE] SK_p => 16 bytes @ 0x91c5340<br>
<br>
Mar3 19:34:45 localhost charon: 06[IKE]0: 43 85 1F D8 CA 8B BD 27 A0 58<div class=""><br>
B8 9F 18 5C E7 C0C......'.X...\..<br>
<br></div>
Mar3 19:34:45 localhost charon: 06[IKE] octets = message + nonce +<div class=""><br>
prf(Sk_px, IDx') => 316 bytes @ 0x91c6d88<br>
<br></div>
Mar3 19:34:45 localhost charon: 06[IKE]0: 95 B5 C1 A2 8D 13 C3 77 00 00<div class=""><br>
00 00 00 00 00 00.......w........<br>
<br></div>
Mar3 19:34:45 localhost charon: 06[IKE]16: 21 20 22 08 00 00 00 00 00 00<div class=""><br>
01 0C 22 00 00 2C! "........."..,<br>
<br></div>
Mar3 19:34:45 localhost charon: 06[IKE]32: 00 00 00 28 01 01 00 04 03 00<div class=""><br>
00 08 01 00 00 03...(............<br>
<br></div>
Mar3 19:34:45 localhost charon: 06[IKE]48: <a href="tel:03%2000%2000" value="+4930000" target="_blank">03 00 00</a> <tel:03%2000%2000><div class=""><br>
08 03 00 00 01 03 00 00 08 02 00 00 01................<br>
<br></div>
Mar3 19:34:45 localhost charon: 06[IKE]64: 00 00 00 08 04 00 00 01 28 00<div class=""><br>
00 68 00 01 00 00........(..h....<br>
<br></div>
Mar3 19:34:45 localhost charon: 06[IKE]80: 23 F4 AC E7 E8 4E 55 80 54 B7<div class=""><br>
14 C8 48 B9 98 AE#....NU.T...H...<br>
<br></div>
Mar3 19:34:45 localhost charon: 06[IKE]96: 15 DB CA F8 93 BF 31 2D 59 89<div class=""><br>
77 52 32 A8 0A 2D......1-Y.wR2..-<br>
<br></div>
Mar3 19:34:45 localhost charon: 06[IKE]112: 78 3E 6F EB 6D 33 5A E6 A5<div class=""><br>
B7 0F 9A 3C DA 4E D8x>o.m3Z.....<.N.<br>
<br></div>
Mar3 19:34:45 localhost charon: 06[IKE]128: E6 71 B4 C4 5A D7 20 48 61<div class=""><br>
B2 34 14 99 0A F6 AF.q..Z. Ha.4.....<br>
<br></div>
Mar3 19:34:45 localhost charon: 06[IKE]144: F8 DB 6D 82 B2 55 6C 1B 84<div class=""><br>
CA 37 8E C3 7F 50 8A..m..Ul...7...P.<br>
<br></div>
Mar3 19:34:45 localhost charon: 06[IKE]160: 5C 2A 39 E4 27 FC 8D 23 38<div class=""><br>
95 E2 B2 F3 F9 8E CA\*9.'..#8.......<br>
<br></div>
Mar3 19:34:45 localhost charon: 06[IKE]176: 29 00 00 24 03 8D 56 09 5D<div class=""><br>
B1 17 D2 BA 29 D6 8B)..$..V.]....)..<br>
<br></div>
Mar3 19:34:45 localhost charon: 06[IKE]192: 7E 0B A5 2D 42 4C 1D 37 D9<div class=""><br>
EA 17 4A 0D 0C 77 67~..-BL.7...J..wg<br>
<br></div>
Mar3 19:34:45 localhost charon: 06[IKE]208: E6 51 40 1D 29 00 00 1C 00<div class=""><br>
00 40 04 D5 2F E3 7F.Q@.).....@../..<br>
<br></div>
Mar3 19:34:45 localhost charon: 06[IKE]224: 13 80 F3 7A 91 9D F2 7A 0A<div class=""><br>
6E C0 A9 E7 B2 72 63...z...z.n....rc<br>
<br></div>
Mar3 19:34:45 localhost charon: 06[IKE]240: 00 00 00 1C 00 00 40 05 BD<div class=""><br>
B4 3E 98 F1 EB F4 10......@...>.....<br>
<br></div>
Mar3 19:34:45 localhost charon: 06[IKE]256: 44 06 6B 25 90 C4 30 CF BB<div class=""><br>
FB FE 4C 00 9B 1E ADD.k%..0....L....<br>
<br></div>
Mar3 19:34:45 localhost charon: 06[IKE]272: 19 7A F6 43 23 A9 8A C4 3C<div class=""><br>
EF 98 57 13 69 07 0E.z.C#...<..W.i..<br>
<br></div>
Mar3 19:34:45 localhost charon: 06[IKE]288: 9A E4 34 F1 A6 9B 48 65 E8<div class=""><br>
06 8A 6C 6D 30 6B C1..4...He...lm0k.<br>
<br></div>
Mar3 19:34:45 localhost charon: 06[IKE]304: F2 2C 6E 19 39 37 C1 C6 2F<br>
48 D2 18.,n.97../H..<br>
<br>
Mar3 19:34:45 localhost charon: 06[CFG]using certificate "CN=1234abcd"<br>
<br>
Mar3 19:34:45 localhost charon: 06[CFG]certificate "CN=1234abcd" key:<br>
2048 bit RSA<br>
<br>
*Mar3 19:34:45 localhost charon: 06[CFG] no issuer certificate found for<br>
"CN=1234abcd"*<br>
<br>
Mar3 19:34:45 localhost charon: 06[IKE] no trusted RSA public key found<br>
for 'CN=1234abcd'<br>
<br>
Mar3 19:34:45 localhost charon: 06[IKE] processing INTERNAL_IP4_ADDRESS<div class=""><br>
attribute<br>
<br>
Please let me know, how to resolve this issue.<br>
<br>
Below post suggests that the intermediate certs need to be sent along<br>
with the end-entity certificates in ike_auth message.<br>
<br>
If that can solve the issue, how can I achieve that.<br>
<br>
<a href="https://lists.strongswan.org/pipermail/users/2013-March/008956.html" target="_blank">https://lists.strongswan.org/<u></u>pipermail/users/2013-March/<u></u>008956.html</a><br>
<br>
Any help in this regard is appreciated.<br>
<br>
Regards,<br>
<br>
Sriram.<br>
<br>
<br>
<br>
<br>
<br>
<br></div>
______________________________<u></u>_________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a><br>
<a href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/<u></u>mailman/listinfo/users</a><br>
<br><span class="HOEnZb"><font color="#888888">
</font></span></blockquote><span class="HOEnZb"><font color="#888888">
<br>
-- <br>
==============================<u></u>==============================<u></u>==========<br>
Andreas Steffen <a href="mailto:andreas.steffen@strongswan.org" target="_blank">andreas.steffen@strongswan.org</a><br>
strongSwan - the Open Source VPN Solution! <a href="http://www.strongswan.org" target="_blank">www.strongswan.org</a><br>
Institute for Internet Technologies and Applications<br>
University of Applied Sciences Rapperswil<br>
CH-8640 Rapperswil (Switzerland)<br>
==============================<u></u>=============================[<u></u>ITA-HSR]==<br>
<br>
</font></span></blockquote></div><br></div>