<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hi,<br>
I have setup strongSwan VPN on my Ubuntu 16.04 server. I'm using
LetEncrypt certificates, and the ipsec daemon does no want to load
the certificates from symbolic link.<br>
<br>
The setup is following:<br>
<br>
Contents of relevant directories:<br>
<br>
<i><a class="moz-txt-link-abbreviated" href="mailto:root@Trinity:/etc/ipsec.d/certs#">root@Trinity:/etc/ipsec.d/certs#</a> ls -la</i><i><br>
celkem 8</i><i><br>
</i><i>drwxr-xr-x 2 root root 4096 úno 9 16:08 ./</i><i><br>
</i><i>drwxr-xr-x 12 root root 4096 úno 8 20:36 ../</i><i><br>
</i><i>lrwxrwxrwx 1 root root 54 úno 9 16:08 fullchain.pem ->
/etc/letsencrypt/live/trinity.ingames.cz/fullchain.pem</i><i><br>
<br>
<a class="moz-txt-link-abbreviated" href="mailto:root@Trinity:/etc/letsencrypt/live/trinity.ingames.cz#">root@Trinity:/etc/letsencrypt/live/trinity.ingames.cz#</a> ls -la<br>
celkem 8<br>
drwxr-xr-x 2 root root 4096 úno 6 20:51 .<br>
drwx------ 3 root root 4096 úno 6 20:51 ..<br>
lrwxrwxrwx 1 root root 42 úno 6 20:51 cert.pem ->
../../archive/trinity.ingames.cz/cert1.pem<br>
lrwxrwxrwx 1 root root 47 úno 6 20:51 fullchain.pem ->
../../archive/trinity.ingames.cz/fullchain1.pem<br>
lrwxrwxrwx 1 root root 43 úno 6 20:51 chain.pem ->
../../archive/trinity.ingames.cz/chain1.pem<br>
lrwxrwxrwx 1 root root 45 úno 6 20:51 privkey.pem ->
../../archive/trinity.ingames.cz/privkey1.pem<br>
<br>
<a class="moz-txt-link-abbreviated" href="mailto:root@Trinity:/etc/letsencrypt/archive/trinity.ingames.cz#">root@Trinity:/etc/letsencrypt/archive/trinity.ingames.cz#</a> ls -la<br>
celkem 24<br>
drwxr-xr-x 2 root root 4096 úno 6 20:51 .<br>
drwx------ 3 root root 4096 úno 6 20:51 ..<br>
-rw-r--r-- 1 root root 1805 úno 6 20:51 cert1.pem<br>
-rw-r--r-- 1 root root 3452 úno 6 20:51 fullchain1.pem<br>
-rw-r--r-- 1 root root 1647 úno 6 20:51 chain1.pem<br>
-rw-r--r-- 1 root root 1704 úno 6 20:51 privkey1.pem<br>
<br>
</i>-------------------------------------<br>
ipsec.conf configuration file<br>
<i># ipsec.conf - strongSwan IPsec configuration file</i><i><br>
</i><i>config setup</i><i><br>
</i><i> charondebug="ike 2, knl 2, cfg 2, net 2, esp 2, dmn 2,
mgr 2"</i><i><br>
</i><i><br>
</i><i>conn %default</i><i><br>
</i><i> keyexchange=ikev2</i><i><br>
</i><i> ike=<plugins></i><i><br>
</i><i> esp=<plugins></i><i><br>
</i><i> dpdaction=restart</i><i><br>
</i><i> dpddelay=10s</i><i><br>
</i><i> dpdtimeout=30s</i><i><br>
</i><i> authby=pubkey</i><i><br>
</i><i> left=%any</i><i><br>
</i><i> leftsubnet=0.0.0.0/0</i><i><br>
</i><i> leftcert=fullchain.pem <------- my symbolic link</i><i><br>
</i><i> leftsendcert=always</i><i><br>
</i><i> right=%any</i><i><br>
</i><i> rightsourceip=192.168.0.110-192.168.0.115</i><i><br>
</i><i> rightdns=192.168.0.253</i><i><br>
</i><i> leftupdown=/home/services/.vpnkeepalive/pluto.sh</i><i><br>
</i><i><br>
</i><i>conn IPSec-eap</i><i><br>
</i><i> keyexchange=ikev2</i><i><br>
</i><i> rightauth=eap-mschapv2</i><i><br>
</i><i> eap_identity=%any</i><i><br>
</i><i> auto=start</i><i><br>
</i><i><br>
</i><i>conn IPSec-IKEv2</i><i><br>
</i><i> keyexchange=ikev2</i><i><br>
</i><i> auto=start</i><br>
<br>
If I launch the ipsec service I get following in the logs:<br>
<i><br>
05[CFG] adding virtual IP address pool 192.168.0.110-192.168.0.115</i><i><br>
</i><b><i>05[LIB] opening '/etc/ipsec.d/certs/fullchain.pem'
failed: Permission denied</i></b><i> <------ </i>Permission
denied opening the symbolic link<br>
<i>05[LIB] building CRED_CERTIFICATE - ANY failed, tried 1 builders</i><i><br>
</i><b><i>05[CFG] loading certificate from 'fullchain.pem' failed</i></b><i><br>
</i><br>
My strongSwan version info:<br>
<br>
<i>root@Trinity:/$ ipsec --version</i><i><br>
</i><i>Linux strongSwan U5.3.5/K4.8.0-32-generic</i><i><br>
</i><i>Institute for Internet Technologies and Applications</i><i><br>
</i><i>University of Applied Sciences Rapperswil, Switzerland</i><i><br>
</i><i>See 'ipsec --copyright' for copyright information.<br>
<br>
</i><br>
If I replace the link with the actual file, everything works fine.
All actions presented were done as root.<br>
<br>
Is there a way to use symlinks instead of actual files?<br>
<br>
Thanks,<br>
JN<br>
</body>
</html>