<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Hi Tobias,<div><br></div><div>I'm getting closer. Then there is still an error saying </div><div><br></div><div>TLS record MAC verification failed</div><div>sending fatal TLS alert 'bad record mac'</div><div><br></div><div>Did a lot of searching to no avail.</div><div>I'm on OpenSSL 1.0.1e 11 Feb 2013 if that helps.</div><div><br></div><div><div>May 2 15:11:49 12[CFG] <1> candidate "winCert", match: 1/1/5 (me/other/ike)</div><div>May 2 15:11:49 12[CFG] <winCert|1> selected peer config 'winCert'</div><div>May 2 15:11:49 12[IKE] <winCert|1> initiating EAP-Identity request</div><div>May 2 15:11:49 12[IKE] <winCert|1> processing INTERNAL_IP4_ADDRESS attribute</div><div>May 2 15:11:49 12[IKE] <winCert|1> processing INTERNAL_IP4_DNS attribute</div><div>May 2 15:11:49 12[IKE] <winCert|1> processing INTERNAL_IP4_NBNS attribute</div><div>May 2 15:11:49 12[IKE] <winCert|1> processing INTERNAL_IP4_SERVER attribute</div><div>May 2 15:11:49 12[IKE] <winCert|1> processing INTERNAL_IP6_ADDRESS attribute</div><div>May 2 15:11:49 12[IKE] <winCert|1> processing INTERNAL_IP6_DNS attribute</div><div>May 2 15:11:49 12[IKE] <winCert|1> processing INTERNAL_IP6_SERVER attribute</div><div>May 2 15:11:49 12[IKE] <winCert|1> peer supports MOBIKE</div><div>May 2 15:11:49 12[IKE] <winCert|1> authentication of 'C=CN, O=EXAMPLE, CN=vpn.EXAMPLE.de' (myself) with RSA signature successful</div><div>May 2 15:11:49 12[IKE] <winCert|1> sending end entity cert "C=CN, O=EXAMPLE, CN=vpn.EXAMPLE.de"</div><div>May 2 15:11:49 13[IKE] <winCert|1> received EAP identity 'client@vpn.EXAMPLE.de'</div><div>May 2 15:11:49 13[TLS] <winCert|1> 33 supported TLS cipher suites:</div><div>May 2 15:11:49 13[TLS] <winCert|1> TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA</div><div>May 2 15:11:49 13[TLS] <winCert|1> TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256</div><div>May 2 15:11:49 13[TLS] <winCert|1> TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA</div><div>May 2 15:11:49 13[TLS] <winCert|1> TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384</div><div>May 2 15:11:49 13[TLS] <winCert|1> TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA</div><div>May 2 15:11:49 13[TLS] <winCert|1> TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256</div><div>May 2 15:11:49 13[TLS] <winCert|1> TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA</div><div>May 2 15:11:49 13[TLS] <winCert|1> TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384</div><div>May 2 15:11:49 13[TLS] <winCert|1> TLS_DHE_RSA_WITH_AES_128_CBC_SHA</div><div>May 2 15:11:49 13[TLS] <winCert|1> TLS_DHE_RSA_WITH_AES_128_CBC_SHA256</div><div>May 2 15:11:49 13[TLS] <winCert|1> TLS_DHE_RSA_WITH_AES_256_CBC_SHA</div><div>May 2 15:11:49 13[TLS] <winCert|1> TLS_DHE_RSA_WITH_AES_256_CBC_SHA256</div><div>May 2 15:11:49 13[TLS] <winCert|1> TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA</div><div>May 2 15:11:49 13[TLS] <winCert|1> TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256</div><div>May 2 15:11:49 13[TLS] <winCert|1> TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA</div><div>May 2 15:11:49 13[TLS] <winCert|1> TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256</div><div>May 2 15:11:49 13[TLS] <winCert|1> TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA</div><div>May 2 15:11:49 13[TLS] <winCert|1> TLS_RSA_WITH_AES_128_CBC_SHA</div><div>May 2 15:11:49 13[TLS] <winCert|1> TLS_RSA_WITH_AES_128_CBC_SHA256</div><div>May 2 15:11:49 13[TLS] <winCert|1> TLS_RSA_WITH_AES_256_CBC_SHA</div><div>May 2 15:11:49 13[TLS] <winCert|1> TLS_RSA_WITH_AES_256_CBC_SHA256</div><div>May 2 15:11:49 13[TLS] <winCert|1> TLS_RSA_WITH_CAMELLIA_128_CBC_SHA</div><div>May 2 15:11:49 13[TLS] <winCert|1> TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256</div><div>May 2 15:11:49 13[TLS] <winCert|1> TLS_RSA_WITH_CAMELLIA_256_CBC_SHA</div><div>May 2 15:11:49 13[TLS] <winCert|1> TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256</div><div>May 2 15:11:49 13[TLS] <winCert|1> TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA</div><div>May 2 15:11:49 13[TLS] <winCert|1> TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA</div><div>May 2 15:11:49 13[TLS] <winCert|1> TLS_RSA_WITH_3DES_EDE_CBC_SHA</div><div>May 2 15:11:49 13[TLS] <winCert|1> TLS_ECDHE_ECDSA_WITH_NULL_SHA</div><div>May 2 15:11:49 13[TLS] <winCert|1> TLS_ECDHE_RSA_WITH_NULL_SHA</div><div>May 2 15:11:49 13[TLS] <winCert|1> TLS_RSA_WITH_NULL_SHA</div><div>May 2 15:11:49 13[TLS] <winCert|1> TLS_RSA_WITH_NULL_SHA256</div><div>May 2 15:11:49 13[TLS] <winCert|1> TLS_RSA_WITH_NULL_MD5</div><div>May 2 15:11:49 13[TLS] <winCert|1> sending EAP_TLS start packet (6 bytes)</div><div>May 2 15:11:49 13[IKE] <winCert|1> initiating EAP_TLS method (id 0x3A)</div><div>May 2 15:11:49 14[TLS] <winCert|1> processing TLS Handshake record (169 bytes)</div><div>May 2 15:11:49 14[TLS] <winCert|1> received TLS ClientHello handshake (165 bytes)</div><div>May 2 15:11:49 14[TLS] <winCert|1> received TLS 'status request' extension</div><div>May 2 15:11:49 14[TLS] <winCert|1> received TLS 'elliptic curves' extension</div><div>May 2 15:11:49 14[TLS] <winCert|1> received TLS 'ec point formats' extension</div><div>May 2 15:11:49 14[TLS] <winCert|1> received TLS 'signature algorithms' extension</div><div>May 2 15:11:49 14[TLS] <winCert|1> received TLS '(35)' extension</div><div>May 2 15:11:49 14[TLS] <winCert|1> received TLS '(23)' extension</div><div>May 2 15:11:49 14[TLS] <winCert|1> received TLS 'renegotiation info' extension</div><div>May 2 15:11:49 14[TLS] <winCert|1> received 30 TLS cipher suites:</div><div>May 2 15:11:49 14[TLS] <winCert|1> TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384</div><div>May 2 15:11:49 14[TLS] <winCert|1> TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256</div><div>May 2 15:11:49 14[TLS] <winCert|1> TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384</div><div>May 2 15:11:49 14[TLS] <winCert|1> TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256</div><div>May 2 15:11:49 14[TLS] <winCert|1> TLS_DHE_RSA_WITH_AES_256_GCM_SHA384</div><div>May 2 15:11:49 14[TLS] <winCert|1> TLS_DHE_RSA_WITH_AES_128_GCM_SHA256</div><div>May 2 15:11:49 14[TLS] <winCert|1> TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384</div><div>May 2 15:11:49 14[TLS] <winCert|1> TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256</div><div>May 2 15:11:49 14[TLS] <winCert|1> TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384</div><div>May 2 15:11:49 14[TLS] <winCert|1> TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256</div><div>May 2 15:11:49 14[TLS] <winCert|1> TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA</div><div>May 2 15:11:49 14[TLS] <winCert|1> TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA</div><div>May 2 15:11:49 14[TLS] <winCert|1> TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA</div><div>May 2 15:11:49 14[TLS] <winCert|1> TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA</div><div>May 2 15:11:49 14[TLS] <winCert|1> TLS_DHE_RSA_WITH_AES_256_CBC_SHA</div><div>May 2 15:11:49 14[TLS] <winCert|1> TLS_DHE_RSA_WITH_AES_128_CBC_SHA</div><div>May 2 15:11:49 14[TLS] <winCert|1> TLS_RSA_WITH_AES_256_GCM_SHA384</div><div>May 2 15:11:49 14[TLS] <winCert|1> TLS_RSA_WITH_AES_128_GCM_SHA256</div><div>May 2 15:11:49 14[TLS] <winCert|1> TLS_RSA_WITH_AES_256_CBC_SHA256</div><div>May 2 15:11:49 14[TLS] <winCert|1> TLS_RSA_WITH_AES_128_CBC_SHA256</div><div>May 2 15:11:49 14[TLS] <winCert|1> TLS_RSA_WITH_AES_256_CBC_SHA</div><div>May 2 15:11:49 14[TLS] <winCert|1> TLS_RSA_WITH_AES_128_CBC_SHA</div><div>May 2 15:11:49 14[TLS] <winCert|1> TLS_RSA_WITH_3DES_EDE_CBC_SHA</div><div>May 2 15:11:49 14[TLS] <winCert|1> TLS_DHE_DSS_WITH_AES_256_CBC_SHA256</div><div>May 2 15:11:49 14[TLS] <winCert|1> TLS_DHE_DSS_WITH_AES_128_CBC_SHA256</div><div>May 2 15:11:49 14[TLS] <winCert|1> TLS_DHE_DSS_WITH_AES_256_CBC_SHA</div><div>May 2 15:11:49 14[TLS] <winCert|1> TLS_DHE_DSS_WITH_AES_128_CBC_SHA</div><div>May 2 15:11:49 14[TLS] <winCert|1> TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA</div><div>May 2 15:11:49 14[TLS] <winCert|1> TLS_RSA_WITH_RC4_128_SHA</div><div>May 2 15:11:49 14[TLS] <winCert|1> TLS_RSA_WITH_RC4_128_MD5</div><div>May 2 15:11:49 14[TLS] <winCert|1> negotiated TLS version TLS 1.2 with suite TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA</div><div>May 2 15:11:49 14[TLS] <winCert|1> sending TLS ServerHello handshake (38 bytes)</div><div>May 2 15:11:49 14[TLS] <winCert|1> sending TLS server certificate 'C=CN, O=EXAMPLE, CN=vpn.EXAMPLE.de'</div><div>May 2 15:11:49 14[TLS] <winCert|1> sending TLS Certificate handshake (853 bytes)</div><div>May 2 15:11:49 14[TLS] <winCert|1> selected ECDH group SECP256R1</div><div>May 2 15:11:49 14[TLS] <winCert|1> created signature with SHA256/RSA</div><div>May 2 15:11:49 14[TLS] <winCert|1> sending TLS ServerKeyExchange handshake (329 bytes)</div><div>May 2 15:11:49 14[TLS] <winCert|1> sending TLS cert request for 'C=CN, O=EXAMPLE, CN=EXAMPLE ca'</div><div>May 2 15:11:49 14[TLS] <winCert|1> sending TLS CertificateRequest handshake (87 bytes)</div><div>May 2 15:11:49 14[TLS] <winCert|1> sending TLS ServerHelloDone handshake (0 bytes)</div><div>May 2 15:11:49 14[TLS] <winCert|1> sending TLS Handshake record (1327 bytes)</div><div>May 2 15:11:49 14[TLS] <winCert|1> sending EAP_TLS first fragment (512 bytes)</div><div>May 2 15:11:49 15[TLS] <winCert|1> received EAP_TLS acknowledgement packet</div><div>May 2 15:11:49 15[TLS] <winCert|1> sending EAP_TLS further fragment (512 bytes)</div><div>May 2 15:11:49 16[TLS] <winCert|1> received EAP_TLS acknowledgement packet</div><div>May 2 15:11:49 16[TLS] <winCert|1> sending EAP_TLS final fragment (330 bytes)</div><div>May 2 15:11:50 09[TLS] <winCert|1> processing TLS Handshake record (1206 bytes)</div><div>May 2 15:11:50 09[TLS] <winCert|1> received TLS Certificate handshake (868 bytes)</div><div>May 2 15:11:50 09[TLS] <winCert|1> received TLS peer certificate 'C=CN, O=EXAMPLE, CN=client@vpn.EXAMPLE.de'</div><div>May 2 15:11:50 09[TLS] <winCert|1> received TLS ClientKeyExchange handshake (66 bytes)</div><div>May 2 15:11:50 09[TLS] <winCert|1> received TLS CertificateVerify handshake (260 bytes)</div><div>May 2 15:11:50 09[CFG] <winCert|1> using certificate "C=CN, O=EXAMPLE, CN=client@vpn.EXAMPLE.de"</div><div>May 2 15:11:50 09[CFG] <winCert|1> certificate "C=CN, O=EXAMPLE, CN=client@vpn.EXAMPLE.de" key: 2048 bit RSA</div><div>May 2 15:11:50 09[CFG] <winCert|1> using trusted ca certificate "C=CN, O=EXAMPLE, CN=EXAMPLE ca"</div><div>May 2 15:11:50 09[CFG] <winCert|1> checking certificate status of "C=CN, O=EXAMPLE, CN=client@vpn.EXAMPLE.de"</div><div>May 2 15:11:50 09[CFG] <winCert|1> ocsp check skipped, no ocsp found</div><div>May 2 15:11:50 09[CFG] <winCert|1> certificate status is not available</div><div>May 2 15:11:50 09[CFG] <winCert|1> certificate "C=CN, O=EXAMPLE, CN=EXAMPLE ca" key: 2048 bit RSA</div><div>May 2 15:11:50 09[CFG] <winCert|1> reached self-signed root ca with a path length of 0</div><div>May 2 15:11:50 09[TLS] <winCert|1> verified signature with SHA1/RSA</div><div>May 2 15:11:50 09[TLS] <winCert|1> processing TLS ChangeCipherSpec record (1 bytes)</div><div>May 2 15:11:50 09[TLS] <winCert|1> processing TLS Handshake record (64 bytes)</div><div>May 2 15:11:50 09[TLS] <winCert|1> TLS record MAC verification failed</div><div>May 2 15:11:50 09[TLS] <winCert|1> sending fatal TLS alert 'bad record mac'</div><div>May 2 15:11:50 09[TLS] <winCert|1> sending TLS Alert record (2 bytes)</div><div>May 2 15:11:50 09[TLS] <winCert|1> sending EAP_TLS packet (17 bytes)</div><div>May 2 15:11:50 05[TLS] <winCert|1> received EAP_TLS acknowledgement packet</div><div>May 2 15:11:50 05[IKE] <winCert|1> EAP method EAP_TLS failed for peer 10.145.250.86</div><div>May 2 15:11:50 05[IKE] <winCert|1> IKE_SA winCert[1] state change: CONNECTING => DESTROYING</div><div><br></div><div>Thanks,</div><div>Arne</div><br>sent from my Windows 8 Tablet
<br><br><div>> Subject: Re: [strongSwan] Win7 and Window10Mobile: IKE authentication credentials are unacceptable<br>> To: arne.j.schmid@outlook.com; users@lists.strongswan.org<br>> From: tobias@strongswan.org<br>> Date: Mon, 2 May 2016 10:22:29 +0200<br>> <br>> Hi Arne,<br>> <br>> > I'm now as far as the connection establishes until there is a "no<br>> > trusted certificate found for 'client@vpn.EXAMPLE.de' to verify TLS peer"<br>> <br>> Your client certificate contains an incorrect subjectAltName extension.<br>> It should be client@vpn.EXAMPLE.de instead of vpn.EXAMPLE.de.<br>> <br>> Regards,<br>> Tobias<br>> <br></div></div> </div></body>
</html>