<div dir="ltr">As an update, copying the certificate from each machine to the other machine, and allowing the remote DN to be learned from the certificate as rightcert=<othersidecert> allows the machines to find the peer config and establish.<div>
<br><div>I'm 99.9% sure the DN text-based rightid/leftid in the config matches whats in the certificate. There's definitely something strange going on here, shouldn't text DNs still work as IDs? Am I missing a change or something?</div>
<div><br></div><div>Here's the relevant ipsec.conf files as I have it mocked up in my testbed:</div><div><div><br></div><div>-- BOX 1 --</div><div># basic configuration</div><div><br></div><div>config setup</div><div>
<span class="" style="white-space:pre"> </span>charondebug="ike 3, knl 2, cfg 3"</div><div><span class="" style="white-space:pre"> </span># strictcrlpolicy=yes</div><div><span class="" style="white-space:pre"> </span># uniqueids = no</div>
<div><br></div><div># Add connections here.</div><div><br></div><div>conn DEVOPS-B</div><div> authby=rsasig</div><div> auto=start</div><div> compress=yes</div><div> dpdaction=clear</div><div> dpddelay=10s</div>
<div> dpdtimeout=20s</div><div> esp=aes256-sha1</div><div> #inactivity=600s</div><div> forceencaps=yes</div><div> #ike=</div><div> type=transport</div><div> keyexchange=ikev2</div>
<div> keyingtries=3</div><div> leftsubnet=<a href="http://192.168.1.10/24">192.168.1.10/24</a></div><div> #leftfirewall=yes</div><div> leftprotoport=47</div><div> leftcert=office.cer</div><div>
left=192.168.1.10</div><div> #leftid="C=US, ST=California, L=Santa Clara, O=Company, Inc, OU=Marketing, CN=<a href="http://office.company.com">office.company.com</a>"</div><div> #leftid=</div>
<div> right=2.2.2.2</div><div> # Peer not found if RightID set to DN and rightcert not specified ??</div><div> #rightid="C=US, ST=California, L=Santa Clara, O=Company, Inc, OU=Marketing, CN=<a href="http://devops.company.com">devops.company.com</a>"</div>
<div> rightcert=devops.cer</div><div><br></div><div><br></div><div>-- BOX 2 --</div><div># basic configuration</div><div><br></div><div>config setup</div><div><span class="" style="white-space:pre"> </span># strictcrlpolicy=yes</div>
<div><span class="" style="white-space:pre"> </span># uniqueids = no</div><div><br></div><div># Add connections here.</div><div><br></div><div>conn OFFICE-1</div><div> authby=rsasig</div><div> auto=start</div>
<div> compress=yes</div><div> dpdaction=clear</div><div> dpddelay=10s</div><div> dpdtimeout=20s</div><div> esp=aes256-sha1</div><div> #inactivity=600s</div><div> forceencaps=yes</div>
<div> #ike=</div><div> type=transport</div><div> keyexchange=ikev2</div><div> keyingtries=3</div><div> leftsubnet=<a href="http://192.168.0.10/24">192.168.0.10/24</a></div><div> #leftfirewall=yes</div>
<div> leftprotoport=47</div><div> leftcert=devops.cer</div><div> left=192.168.0.10</div><div> #leftid="C=US, ST=California, L=Santa Clara, O=Company, Inc, OU=Marketing, CN=<a href="http://devops.company.com">devops.company.com</a>"</div>
<div> #leftid=</div><div> right=1.1.1.1</div><div> # Peer not found if RightID set to DN and rightcert not specified ?? </div><div> #rightid="C=US, ST=California, L=Santa Clara, O=Company, Inc, OU=Marketing, CN=<a href="http://office.company.com">office.company.com</a>"</div>
<div> rightcert=office.cer</div></div><div><br></div><div>Any thoughts?</div><div><br></div><div>TIA,</div><div>Aaron</div><div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, May 30, 2014 at 12:19 PM, Aaron Edwards <span dir="ltr"><<a href="mailto:aaron@ebob9.com" target="_blank">aaron@ebob9.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr">Hi All,<div><br></div><div>Looking for some troubleshooting direction here.</div>
<div><br></div><div>I'm setting up a strongswan to strongswan VPN, authenticating using DN-based IDs on certificates from a private CA. </div>
<div><br></div><div>I've done this a *bunch* of times before with earlier self-compiled versions (5.0.1-5.1.0), however in 5.1.2 that comes with Ubuntu 14.04, Strongswan does not seem to like my ID:</div><div><br></div>
<div>May 30 18:54:12 office-gilligan charon: 10[CFG] id 'C=US, ST=California, L=Santa Clara, O=Company, Inc, OU=Marketing, CN=<a href="http://office.company.com" target="_blank">office.company.com</a>' not confirmed by certificate, defaulting to 'C=US, ST=California, L=Santa Clara, O=Company, Inc, OU=Marketing, CN=<a href="http://office.company.com" target="_blank">office.company.com</a>'<br>
</div><div><br></div><div>Later on, when the peer tries to connect, I get a "peer config not found". Note - I am not using SANs in my certificates (thus why I have been doing DN-based auth), which has worked before.</div>
<div><br></div><div>Are there any changes/ known bugs from 5.1.0 to 5.1.2 that could cause this? If not, are there any configuration/compilation options that could cause this? Just looking for ideas on what to try next.</div>
<div><br></div><div>Thanks,</div><div>Aaron</div></div>
</blockquote></div><br></div></div></div></div>