<div dir="ltr"><div><div>Hi,<br></div> I've been able to get StrongSwan working using PSK, but now I'm trying to use certificates. I followed the wiki for setting up a simple CA and generated the keys and stored them in the associated directories (<a href="http://wiki.strongswan.org/projects/strongswan/wiki/SimpleCA">http://wiki.strongswan.org/projects/strongswan/wiki/SimpleCA</a>). When I start StrongSwan it fails and the log displays the following:<br>
<br>May 9 15:08:57 00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'<br>May 9 15:08:57 00[LIB] building CRED_CERTIFICATE - X509 failed, tried 2 builders<br>May 9 15:08:57 00[CFG] loading ca certificate from '/etc/ipsec.d/cacerts/caCert.der' failed<br>
May 9 15:08:57 00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'<br>May 9 15:08:57 00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'<br>May 9 15:08:57 00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'<br>
May 9 15:08:57 00[CFG] loading crls from '/etc/ipsec.d/crls'<br>May 9 15:08:57 00[CFG] loading secrets from '/etc/ipsec.secrets'<br>May 9 15:08:57 00[LIB] building CRED_PRIVATE_KEY - RSA failed, tried 3 builders<br>
May 9 15:08:57 00[CFG] loading private key from '/etc/ipsec.d/private/strongSwan3Key.der' failed<br>May 9 15:08:57 00[LIB] loaded plugins: charon aes sha1 sha2 md5 openssl random nonce hmac stroke kernel-netlink socket-default updown pkcs1 x509<br>
........<br>May 9 15:08:57 05[CFG] conn home<br>May 9 15:08:57 05[CFG] left=192.168.0.3<br>May 9 15:08:57 05[CFG] leftsubnet=(null)<br>May 9 15:08:57 05[CFG] leftsourceip=(null)<br>May 9 15:08:57 05[CFG] leftdns=(null)<br>
May 9 15:08:57 05[CFG] leftauth=pubkey<br>May 9 15:08:57 05[CFG] leftauth2=(null)<br>May 9 15:08:57 05[CFG] leftid=%any<br>May 9 15:08:57 05[CFG] leftid2=(null)<br>May 9 15:08:57 05[CFG] leftrsakey=(null)<br>
May 9 15:08:57 05[CFG] leftcert=strongSwan3Key.der<br>May 9 15:08:57 05[CFG] leftcert2=(null)<br>May 9 15:08:57 05[CFG] leftca=(null)<br>May 9 15:08:57 05[CFG] leftca2=(null)<br>May 9 15:08:57 05[CFG] leftgroups=(null)<br>
May 9 15:08:57 05[CFG] leftgroups2=(null)<br>May 9 15:08:57 05[CFG] leftupdown=(null)<br>May 9 15:08:57 05[CFG] right=192.168.0.2<br>May 9 15:08:57 05[CFG] rightsubnet=(null)<br>May 9 15:08:57 05[CFG] rightsourceip=(null)<br>
May 9 15:08:57 05[CFG] rightdns=(null)<br>May 9 15:08:57 05[CFG] rightauth=pubkey<br>May 9 15:08:57 05[CFG] rightauth2=(null)<br>May 9 15:08:57 05[CFG] rightid=%any<br>May 9 15:08:57 05[CFG] rightid2=(null)<br>
May 9 15:08:57 05[CFG] rightrsakey=(null)<br>May 9 15:08:57 05[CFG] rightcert=(null)<br>May 9 15:08:57 05[CFG] rightcert2=(null)<br>May 9 15:08:57 05[CFG] rightca=(null)<br>May 9 15:08:57 05[CFG] rightca2=(null)<br>
May 9 15:08:57 05[CFG] rightgroups=(null)<br>May 9 15:08:57 05[CFG] rightgroups2=(null)<br>May 9 15:08:57 05[CFG] rightupdown=(null)<br>May 9 15:08:57 05[CFG] eap_identity=(null)<br>May 9 15:08:57 05[CFG] aaa_identity=(null)<br>
May 9 15:08:57 05[CFG] xauth_identity=(null)<br>May 9 15:08:57 05[CFG] ike=aes256-sha384-ecp384bp<br>May 9 15:08:57 05[CFG] esp=aes256gcm16<br>May 9 15:08:57 05[CFG] ah=(null)<br>May 9 15:08:57 05[CFG] dpddelay=30<br>
May 9 15:08:57 05[CFG] dpdtimeout=150<br>May 9 15:08:57 05[CFG] dpdaction=0<br>May 9 15:08:57 05[CFG] closeaction=0<br>May 9 15:08:57 05[CFG] mediation=no<br>May 9 15:08:57 05[CFG] mediated_by=(null)<br>May 9 15:08:57 05[CFG] me_peerid=(null)<br>
May 9 15:08:57 05[CFG] keyexchange=ikev2<br><br><br></div><div>If I do "sudo ipsec listcerts" it comes back empty, but if i do "pki --verify --in /etc/ipsec.d/certs/strongSwan2Cert.der --ca /etc/ipsec.d/cacerts/caCert.der" it says:<br>
</div><div>signature good, certificates valid<br><br></div><div>Any ideas?<br><br>Thanks,<br></div><div> Brian<br></div><div><br><br></div><br><div><div><br></div></div></div>