<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
I'm having a problem getting PKI-authenticated connections from BB10
smartphones to work.<br>
<br>
PSK-authentication works; I have the following stanza in ipsec.conf:<br>
<br>
conn BB10<br>
left=%any<br>
leftsubnet=0.0.0.0/0<br>
right=%any<br>
rightsourceip=192.168.2.0/24<br>
rightauth=psk<br>
leftcert=genesis.denninger.net.crt<br>
leftauth=pubkey<br>
auto=add<br>
<br>
This works fine; the proper secret is in the ipsec.secrets file.<br>
<br>
If I change "rightauth" to "pubkey", however, and specify a client
certificate to be sent on the client side I get this:<br>
<br>
Mar 24 23:30:19 NewFS charon: 16[NET] sending packet: from
70.169.168.7[500] to 192.168.1.21[500] (333 bytes)<br>
Mar 24 23:30:19 NewFS charon: 16[NET] received packet: from
192.168.1.21[500] to 70.169.168.7[500] (2444 bytes)<br>
Mar 24 23:30:19 NewFS charon: 16[ENC] parsed IKE_AUTH request 1 [
IDi CERT CERTREQ AUTH CPRQ(ADDR MASK DNS DNS NBNS NBNS VER)
N(INIT_CONTACT) N(ESP_TFC_PAD_N) N(NON_FIRST_FRAG) SA TSi TSr ]<br>
Mar 24 23:30:19 NewFS charon: 16[IKE] received end entity cert
"C=US, ST=Florida, O=Cuda Systems LLC, CN=Karl Denninger,
<a class="moz-txt-link-abbreviated" href="mailto:E=karl@denninger.net">E=karl@denninger.net</a>"<br>
Mar 24 23:30:19 NewFS charon: 16[CFG] looking for peer configs
matching 70.169.168.7[%any]...192.168.1.21[<a class="moz-txt-link-abbreviated" href="mailto:karl@denninger.net">karl@denninger.net</a>]<br>
Mar 24 23:30:19 NewFS charon: 16[CFG] selected peer config 'BB10'<br>
Mar 24 23:30:19 NewFS charon: 16[IKE] no trusted RSA public key
found for '<a class="moz-txt-link-abbreviated" href="mailto:karl@denninger.net">karl@denninger.net</a>'<br>
<br>
The public key, however, IS in the ipsec.d/certs directory and IS
readable. In addition "ipsec listcacerts" does show the CA that
issued the machine certificate.<br>
<br>
However, "ipsec listcerts" does not display it; all it shows is the
machine cert for the server:<br>
<br>
[root@NewFS /usr/local/etc/ipsec.d]# ipsec listcerts<br>
<br>
List of X.509 End Entity Certificates:<br>
<br>
subject: "C=US, ST=Florida, O=Cuda Systems LLC,
CN=genesis.denninger.net, <a class="moz-txt-link-abbreviated" href="mailto:E=postmaster@genesis.denninger.net">E=postmaster@genesis.denninger.net</a>"<br>
issuer: "C=US, ST=Florida, L=Niceville, O=Cuda Systems LLC,
CN=Cuda Systems LLC CA, E=Cuda Systems LLC CA"<br>
serial: 17<br>
validity: not before Mar 24 22:48:26 2015, ok<br>
not after Mar 21 22:48:26 2025, ok <br>
pubkey: RSA 4096 bits, has private key<br>
keyid:
58:e0:39:09:a8:60:69:4e:80:4e:03:c5:03:d4:62:4d:0e:f3:80:7d<br>
subjkey:
e7:7b:7c:61:2e:5e:af:06:d0:9d:ff:29:3d:12:ae:a2:61:bf:60:56<br>
authkey:
24:71:9b:9d:85:7d:fc:dd:dd:bd:b0:ca:92:94:03:a1:fa:d3:6d:35<br>
[root@NewFS /usr/local/etc/ipsec.d]# <br>
<br>
What am I missing?<br>
<br>
<div class="moz-signature">-- <br>
Karl Denninger<br>
<a href="mailto:karl@denninger.net">karl@denninger.net</a><br>
<i>The Market Ticker</i>
</div>
</body>
</html>