<div dir="ltr"><div><div>Thank you for your answer. Here is the log:<br><br>root@127.0.0.1:~$ ipsec up lap1<br>initiating IKE_SA lap1[1] to 192.168.10.152<br>generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]<br>sending packet: from 172.27.10.142[500] to 192.168.10.152[500] (588 bytes)<br>received packet: from 192.168.10.152[500] to 172.27.10.142[500] (517 bytes)<br>parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(MULT_AUTH) ]<br>received cert request for "O=Firm, CN=Root_CA, C=CN, ST=Land, L=City, E=<a href="mailto:e@mail.com">e@mail.com</a>, OU=Firm, OU=CA_ROOT"<br>received 3 cert requests for an unknown ca<br>sending cert request for "O=Firm, CN=Root_CA, C=CN, ST=Land, L=City, E=<a href="mailto:e@mail.com">e@mail.com</a>, OU=Firm, OU=CA_ROOT"<br>authentication of 'CN=EndDeviceName, ST=Land, C=CN, E=<a href="mailto:e@mail.com">e@mail.com</a>, O=Firm, L=City, OU=UnitName, OU=EndDevices' (myself) with RSA signature successful<br>sending end entity cert "CN=EndDeviceName, ST=Land, C=CN, E=<a href="mailto:e@mail.com">e@mail.com</a>, O=Firm, L=City, OU=UnitName, OU=EndDevices"<br>establishing CHILD_SA lap1<br>generating IKE_AUTH request 1 [ IDi CERT CERTREQ AUTH SA TSi TSr N(MULT_AUTH) N(EAP_ONLY) ]<br>sending packet: from 172.27.10.142[500] to 192.168.10.152[500] (2165 bytes)<br>received packet: from 192.168.10.152[500] to 172.27.10.142[500] (5295 bytes)<br>parsed IKE_AUTH response 1 [ IDr CERT CERT CERT AUTH SA TSi TSr N(AUTH_LFT) ]<br>received end entity cert "CN=GateName, ST=Land, C=CN, E=<a href="mailto:e@mail.com">e@mail.com</a>, O=Firm, L=City, OU=UnitName, OU=EndDevices"<br>received issuer cert "CN=Master, ST=Land, C=CN, E=<a href="mailto:e@mail.com">e@mail.com</a>, O=Firm, L=City, OU=UnitName, OU=Master"<br>received issuer cert "CN=Signing_CA, ST=Land, C=CN, E=<a href="mailto:e@mail.com">e@mail.com</a>, O=Firm, L=City, OU=Firm, OU=SIGNING_CA"<br> using certificate "CN=GateName, ST=Land, C=CN, E=<a href="mailto:e@mail.com">e@mail.com</a>, O=Firm, L=City, OU=UnitName, OU=EndDevices"<br> using untrusted intermediate certificate "CN=Master, ST=Land, C=CN, E=<a href="mailto:e@mail.com">e@mail.com</a>, O=Firm, L=City, OU=UnitName, OU=Master"<br>checking certificate status of "CN=GateName, ST=Land, C=CN, E=<a href="mailto:e@mail.com">e@mail.com</a>, O=Firm, L=City, OU=UnitName, OU=EndDevices"<br>certificate status is not available<br> using untrusted intermediate certificate "CN=Signing_CA, ST=Land, C=CN, E=<a href="mailto:e@mail.com">e@mail.com</a>, O=Firm, L=City, OU=Firm, OU=SIGNING_CA"<br>checking certificate status of "CN=Master, ST=Land, C=CN, E=<a href="mailto:e@mail.com">e@mail.com</a>, O=Firm, L=City, OU=UnitName, OU=Master"<br>certificate status is not available<br> using trusted ca certificate "O=Firm, CN=Root_CA, C=CN, ST=Land, L=City, E=<a href="mailto:e@mail.com">e@mail.com</a>, OU=Firm, OU=CA_ROOT"<br>checking certificate status of "CN=Signing_CA, ST=Land, C=CN, E=<a href="mailto:e@mail.com">e@mail.com</a>, O=Firm, L=City, OU=Firm, OU=SIGNING_CA"<br>certificate status is not available<br> reached self-signed root ca with a path length of 2<br>authentication of 'CN=GateName, ST=Land, C=CN, E=<a href="mailto:e@mail.com">e@mail.com</a>, O=Firm, L=City, OU=UnitName, OU=EndDevices' with RSA signature successful<br>IKE_SA lap1[1] established between 172.27.10.142[CN=EndDeviceName, ST=Land, C=CN, E=<a href="mailto:e@mail.com">e@mail.com</a>, O=Firm, L=City, OU=UnitName, OU=EndDevices]...192.168.10.152[CN=GateName, ST=Land, C=CN, E=<a href="mailto:e@mail.com">e@mail.com</a>, O=Firm, L=City, OU=UnitName, OU=EndDevices]<br>scheduling reauthentication in 6694s<br>maximum IKE_SA lifetime 6994s<br>connection 'lap1' established successfully<br>root@127.0.0.1:~$<br><br><br><br>as I was doing many experiments, current log is from scenario where:<br><br>rightid="%any"<br>rightca="CN=aa, ST=aa, C=aa, E=aa, O=aa, L=aa, OU=aa, OU=aa"<br><br><br>Are these logs enough for you? Of course I've changed the data taken from certs showed in log but I've done this consistently.<br><br>Are there any log or info accessible informing that rightca is checked during authentication process?<br><br></div>Regards,<br></div>John<br></div><div class="gmail_extra"><br><div class="gmail_quote">2016-11-23 19:50 GMT+01:00 Andreas Steffen <span dir="ltr"><<a href="mailto:andreas.steffen@strongswan.org" target="_blank">andreas.steffen@strongswan.org</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi John,<br>
<br>
could you send me a log file showing that a CA different from the CA<br>
requested by rightca is accepted?<br>
<br>
Best regards<br>
<br>
Andreas<span class=""><br>
<br>
On 23.11.2016 16:41, John Brown wrote:<br>
</span><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">
Hello all,<br>
<br>
I'm using Linux strongSwan U5.2.1/K3.4.112 and I'm trying to implement<br>
rightca option in ipsec.conf file but without a success.<br>
<br>
As far as I understand the documentation, if rightca contains DN of a<br>
certificate authority which lies in the trust path from the end device<br>
cert to rootca, authentication process will pass (assuming that other<br>
elements are configured fine) otherwise will fail and this is the<br>
functionality I need. But in my scenario, whatever is the value of<br>
rightca, the authentication process pass with success.<br>
<br>
I've put rightca on the initiator of IKEv2 tunnel, root ca chain path<br>
lenght is 2 (root ca->sub1->sub2->end device cert). Currently only root<br>
ca is installed in /etc/ipsec.d/cacerts.<br>
<br>
Part of the connection config:<br>
<br>
conn lap1<br>
auto=add<br>
left=%any<br>
right=192.168.1.1<br></span>
rightsubnet=<a href="http://10.0.0.0/24" rel="noreferrer" target="_blank">10.0.0.0/24</a> <<a href="http://10.0.0.0/24" rel="noreferrer" target="_blank">http://10.0.0.0/24</a>><span class=""><br>
...<br>
leftauth=pubkey<br>
rightauth=pubkey<br>
leftcert=cert.crt<br>
rightid="CN=*, ST=Stttt, C=Cccc, E=E@eeee, O=Oooooo, L=Lllllll,<br>
OU=*, OU=Ouuuuuu"<br>
rightca="CN=aa, ST=aa, C=aa, E=aa, O=aa, L=aa, OU=aa, OU=aa"<br>
<br>
I've changed values of fields in righid, but rightca is taken from real<br>
config without modification.<br>
<br>
I'm probably missing something obvious, or does not understand this<br>
feature, but I have no idea, what this can be.<br>
<br>
Does anybody knows?<br>
<br>
Best regards,<br>
John,<br>
</span></blockquote>
<br>
==============================<wbr>==============================<wbr>==========<br>
Andreas Steffen <a href="mailto:andreas.steffen@strongswan.org" target="_blank">andreas.steffen@strongswan.<wbr>org</a><br>
strongSwan - the Open Source VPN Solution! <a href="http://www.strongswan.org" rel="noreferrer" target="_blank">www.strongswan.org</a><br>
Institute for Internet Technologies and Applications<br>
University of Applied Sciences Rapperswil<br>
CH-8640 Rapperswil (Switzerland)<br>
==============================<wbr>=============================[<wbr>ITA-HSR]==<br>
<br>
</blockquote></div><br></div>