<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
I reissued the certificate with subjectAltName set and was
successful -- thanks!<br>
<br>
<div class="moz-cite-prefix">On 3/25/2015 07:49, Andreas Steffen
wrote:<br>
</div>
<blockquote cite="mid:5512AECE.3040804@strongswan.org" type="cite">
<pre wrap="">Hi Karl,
in order to find a match, the IKEv2 ID '<a class="moz-txt-link-abbreviated" href="mailto:karl@denninger.net">karl@denninger.net</a>' must be
contained as a subjectAltName in the X.509 client certificate.
strongSwan does not do any matching to the CN= or E= fields of
the certificate's subjectDistinguishedName.
Best regards
Andreas
On 03/25/2015 05:36 AM, Karl Denninger wrote:
</pre>
<blockquote type="cite">
<pre wrap="">I'm having a problem getting PKI-authenticated connections from BB10
smartphones to work.
PSK-authentication works; I have the following stanza in ipsec.conf:
conn BB10
left=%any
leftsubnet=0.0.0.0/0
right=%any
rightsourceip=192.168.2.0/24
rightauth=psk
leftcert=genesis.denninger.net.crt
leftauth=pubkey
auto=add
This works fine; the proper secret is in the ipsec.secrets file.
If I change "rightauth" to "pubkey", however, and specify a client
certificate to be sent on the client side I get this:
Mar 24 23:30:19 NewFS charon: 16[NET] sending packet: from
70.169.168.7[500] to 192.168.1.21[500] (333 bytes)
Mar 24 23:30:19 NewFS charon: 16[NET] received packet: from
192.168.1.21[500] to 70.169.168.7[500] (2444 bytes)
Mar 24 23:30:19 NewFS charon: 16[ENC] parsed IKE_AUTH request 1 [ IDi
CERT CERTREQ AUTH CPRQ(ADDR MASK DNS DNS NBNS NBNS VER) N(INIT_CONTACT)
N(ESP_TFC_PAD_N) N(NON_FIRST_FRAG) SA TSi TSr ]
Mar 24 23:30:19 NewFS charon: 16[IKE] received end entity cert "C=US,
ST=Florida, O=Cuda Systems LLC, CN=Karl Denninger, <a class="moz-txt-link-abbreviated" href="mailto:E=karl@denninger.net">E=karl@denninger.net</a>"
Mar 24 23:30:19 NewFS charon: 16[CFG] looking for peer configs matching
70.169.168.7[%any]...192.168.1.21[<a class="moz-txt-link-abbreviated" href="mailto:karl@denninger.net">karl@denninger.net</a>]
Mar 24 23:30:19 NewFS charon: 16[CFG] selected peer config 'BB10'
Mar 24 23:30:19 NewFS charon: 16[IKE] no trusted RSA public key found
for '<a class="moz-txt-link-abbreviated" href="mailto:karl@denninger.net">karl@denninger.net</a>'
The public key, however, IS in the ipsec.d/certs directory and IS
readable. In addition "ipsec listcacerts" does show the CA that issued
the machine certificate.
However, "ipsec listcerts" does not display it; all it shows is the
machine cert for the server:
[root@NewFS /usr/local/etc/ipsec.d]# ipsec listcerts
List of X.509 End Entity Certificates:
subject: "C=US, ST=Florida, O=Cuda Systems LLC,
CN=genesis.denninger.net, <a class="moz-txt-link-abbreviated" href="mailto:E=postmaster@genesis.denninger.net">E=postmaster@genesis.denninger.net</a>"
issuer: "C=US, ST=Florida, L=Niceville, O=Cuda Systems LLC, CN=Cuda
Systems LLC CA, E=Cuda Systems LLC CA"
serial: 17
validity: not before Mar 24 22:48:26 2015, ok
not after Mar 21 22:48:26 2025, ok
pubkey: RSA 4096 bits, has private key
keyid: 58:e0:39:09:a8:60:69:4e:80:4e:03:c5:03:d4:62:4d:0e:f3:80:7d
subjkey: e7:7b:7c:61:2e:5e:af:06:d0:9d:ff:29:3d:12:ae:a2:61:bf:60:56
authkey: 24:71:9b:9d:85:7d:fc:dd:dd:bd:b0:ca:92:94:03:a1:fa:d3:6d:35
[root@NewFS /usr/local/etc/ipsec.d]#
What am I missing?
--
Karl Denninger
<a class="moz-txt-link-abbreviated" href="mailto:karl@denninger.net">karl@denninger.net</a> <a class="moz-txt-link-rfc2396E" href="mailto:karl@denninger.net"><mailto:karl@denninger.net></a>
/The Market Ticker/
</pre>
</blockquote>
<pre wrap="">
======================================================================
Andreas Steffen <a class="moz-txt-link-abbreviated" href="mailto:andreas.steffen@strongswan.org">andreas.steffen@strongswan.org</a>
strongSwan - the Open Source VPN Solution! <a class="moz-txt-link-abbreviated" href="http://www.strongswan.org">www.strongswan.org</a>
Institute for Internet Technologies and Applications
University of Applied Sciences Rapperswil
CH-8640 Rapperswil (Switzerland)
===========================================================[ITA-HSR]==
</pre>
</blockquote>
<br>
<div class="moz-signature">-- <br>
Karl Denninger<br>
<a href="mailto:karl@denninger.net">karl@denninger.net</a><br>
<i>The Market Ticker</i>
</div>
</body>
</html>