<div dir="ltr">I have seen this issue before and fixed it. But this time I am not able to figure you. Let me know if anyone see issue or any suggestion. Thanks in advance.<div><br></div><div>Problem: </div><div>Getting error while initiating the connection.</div><div><p class="MsoNormal"><font color="#1f497d"><b>[IKE] no private key found for 'fc00:cada:c404:607::1001'</b></font></p><p class="MsoNormal"><font color="#1f497d"><b>11[IKE] no private key found for 'fc00:cada:c404:607::1001'</b></font></p><p class="MsoNormal"><font color="#1f497d"><b><br></b></font></p><p class="MsoNormal"><font color="#1f497d"><b><br></b></font></p><p class="MsoNormal"><font color="#1f497d"><b><br></b></font></p></div><div><br></div><div>We are able to load the certificate and keys. looking at logs following are proof.</div><div> <br></div><div><br></div><div><p class="MsoNormal"><span style="color:rgb(31,73,125)">messages.0:Jan 1 09:09:23
E6kn-2016 <a href="http://daemon.info">daemon.info</a> : 08[CFG] loaded RSA private key<span></span></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125)">messages.0:Jan 1 09:09:23
E6kn-2016 <a href="http://daemon.info">daemon.info</a> : 08[CFG] loaded certificate 'C=US, O=CableLabs, OU=TEST
Root CA01, CN=TEST CableLabs Root Certification Authority'<span></span></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125)">messages.0:Jan 1 09:09:23
E6kn-2016 <a href="http://daemon.info">daemon.info</a> : 08[CFG] loaded certificate 'C=US, O=ARRIS, OU=LOWELL,
CN=00:33:5f:ab:8c:9e'<span></span></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125)">messages.0:Jan 1 09:09:23
E6kn-2016 <a href="http://daemon.info">daemon.info</a> : 08[CFG] loaded certificate 'C=US, O=CableLabs, OU=TEST
Device CA01, CN=TEST CableLabs Device Certification Authority'<span></span></span></p><p class="MsoNormal"><span style="color:rgb(31,73,125)"><br></span></p><p class="MsoNormal"><span style="color:rgb(31,73,125)"><br></span></p><p class="MsoNormal"><font color="#1f497d">But when I initiate a connection, I get the following.</font></p><p class="MsoNormal"><font color="#1f497d"><br></font></p><p class="MsoNormal"><font color="#1f497d"><br></font></p><p class="MsoNormal"><font color="#1f497d">root@E6kn-2016:# swanctl --initiate --child gcpfc00:cada:c404::200</font></p><p class="MsoNormal"><font color="#1f497d">07[CFG] vici initiate 'gcpfc00:cada:c404::200'</font></p><p class="MsoNormal"><font color="#1f497d">09[IKE] initiating IKE_SA rpdfc00:cada:c404::200[1] to 2017::5002</font></p><p class="MsoNormal"><font color="#1f497d">[IKE] initiating IKE_SA rpdfc00:cada:c404::200[1] to 2017::5002</font></p><p class="MsoNormal"><font color="#1f497d">[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(HASH_ALG) N(REDIR_SUP) ]</font></p><p class="MsoNormal"><font color="#1f497d">09[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(HASH_ALG) N(REDIR_SUP) ]</font></p><p class="MsoNormal"><font color="#1f497d">[NET] sending packet: from fc00:cada:c404:607::1001[500] to 2017::5002[500] (264 bytes)</font></p><p class="MsoNormal"><font color="#1f497d">09[NET] sending packet: from fc00:cada:c404:607::1001[500] to 2017::5002[500] (264 bytes)</font></p><p class="MsoNormal"><font color="#1f497d">11[NET] received packet: from 2017::5002[500] to fc00:cada:c404:607::1001[500] (289 bytes)</font></p><p class="MsoNormal"><font color="#1f497d">[NET] received packet: from 2017::5002[500] to fc00:cada:c404:607::1001[500] (289 bytes)</font></p><p class="MsoNormal"><font color="#1f497d">11[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(HASH_ALG) N(MULT_AUTH) ]</font></p><p class="MsoNormal"><font color="#1f497d">[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(HASH_ALG) N(MULT_AUTH) ]</font></p><p class="MsoNormal"><font color="#1f497d">[IKE] received cert request for "C=US, O=CableLabs, OU=TEST Device CA01, CN=TEST CableLabs Device Certification Authority"</font></p><p class="MsoNormal"><font color="#1f497d">11[IKE] received cert request for "C=US, O=CableLabs, OU=TEST Device CA01, CN=TEST CableLabs Device Certification Authority"</font></p><p class="MsoNormal"><font color="#1f497d">[IKE] sending cert request for "C=US, O=CableLabs, OU=TEST Device CA01, CN=TEST CableLabs Device Certification Authority"</font></p><p class="MsoNormal"><font color="#1f497d">11[IKE] sending cert request for "C=US, O=CableLabs, OU=TEST Device CA01, CN=TEST CableLabs Device Certification Authority"</font></p><p class="MsoNormal"><font color="#1f497d">[IKE] sending cert request for "C=US, O=CableLabs, OU=TEST Root CA01, CN=TEST CableLabs Root Certification Authority"</font></p><p class="MsoNormal"><font color="#1f497d">11[IKE] sending cert request for "C=US, O=CableLabs, OU=TEST Root CA01, CN=TEST CableLabs Root Certification Authority"</font></p><p class="MsoNormal"><font color="#1f497d"><b>[IKE] no private key found for 'fc00:cada:c404:607::1001'</b></font></p><p class="MsoNormal"><font color="#1f497d"><b>11[IKE] no private key found for 'fc00:cada:c404:607::1001'</b></font></p><p class="MsoNormal"><b><font color="#1f497d"></font></b></p><p class="MsoNormal"><font color="#1f497d"><b>initiate failed: establishing CHILD_SA 'gcpfc00:cada:c404::200' failed</b></font></p><p class="MsoNormal"><font color="#1f497d"><br></font></p><p class="MsoNormal"><font color="#1f497d"><br></font></p><p class="MsoNormal"><font color="#1f497d"><br></font></p><p class="MsoNormal"><font color="#1f497d"><br></font></p><p class="MsoNormal"><font color="#1f497d">root@E6kn-2016:# swanctl --list-conns</font></p><p class="MsoNormal"><font color="#1f497d">rpdfc00:cada:c404::200: IKEv2, no reauthentication, rekeying every 14400s</font></p><p class="MsoNormal"><font color="#1f497d"> local: fc00:cada:c404:607::1001</font></p><p class="MsoNormal"><font color="#1f497d"> remote: 2017::5002</font></p><p class="MsoNormal"><font color="#1f497d"> local public key authentication:</font></p><p class="MsoNormal"><font color="#1f497d"> id: fc00:cada:c404:607::1001</font></p><p class="MsoNormal"><font color="#1f497d"> remote public key authentication:</font></p><p class="MsoNormal"><font color="#1f497d"> gcpfc00:cada:c404::200: TRANSPORT, rekeying every 3600s</font></p><p class="MsoNormal"><font color="#1f497d"> local: fc00:cada:c404:607::1001/128[tcp]</font></p><p class="MsoNormal"><font color="#1f497d"> remote: 2017::5002/128[tcp]</font></p><p class="MsoNormal"><font color="#1f497d"> l2tpfc00:cada:c404::200: TRANSPORT, rekeying every 3600s</font></p><p class="MsoNormal"><font color="#1f497d"> local: fc00:cada:c404:607::1001/128[l2tp]</font></p><p class="MsoNormal"><font color="#1f497d"></font></p><p class="MsoNormal"><font color="#1f497d"> remote: 2017::5002/128[l2tp]</font></p><p class="MsoNormal"><font color="#1f497d"><br></font></p><p class="MsoNormal"><font color="#1f497d"><br></font></p><p class="MsoNormal"><font color="#1f497d"><br></font></p><p class="MsoNormal"><font color="#1f497d">root@E6kn-2016:# swanctl --list-certs</font></p><p class="MsoNormal"><font color="#1f497d"><br></font></p><p class="MsoNormal"><font color="#1f497d">List of X.509 End Entity Certificates</font></p><p class="MsoNormal"><font color="#1f497d"><br></font></p><p class="MsoNormal"><font color="#1f497d"> subject: "C=US, O=ARRIS, OU=LOWELL, CN=00:33:5f:ab:8c:9e"</font></p><p class="MsoNormal"><font color="#1f497d"> issuer: "C=US, O=CableLabs, OU=TEST Device CA01, CN=TEST CableLabs Device Certification Authority"</font></p><p class="MsoNormal"><font color="#1f497d"> validity: not before Sep 28 18:18:53 2017, ok</font></p><p class="MsoNormal"><font color="#1f497d"> not after Sep 28 18:18:53 2037, ok (expires in 7300 days)</font></p><p class="MsoNormal"><font color="#1f497d"> serial: dd:dc:09:21:36:f2:e8:71</font></p><p class="MsoNormal"><font color="#1f497d"> authkeyId: f6:dc:40:8a:89:b6:7b:7a:08:f6:78:b5:4a:28:7a:7f:57:9b:f9:9b</font></p><p class="MsoNormal"><font color="#1f497d"> subjkeyId: 9d:c7:c5:20:f7:bf:0c:fb:39:d2:5d:a2:8f:73:37:f1:f3:e0:a4:f9</font></p><p class="MsoNormal"><font color="#1f497d"> pubkey: RSA 2048 bits, has private key</font></p><p class="MsoNormal"><font color="#1f497d"> keyid: 8d:40:7d:fb:38:7b:4b:e2:fe:00:ba:72:6c:82:63:2b:6b:75:30:6e</font></p><p class="MsoNormal"><font color="#1f497d"> subjkey: 9d:c7:c5:20:f7:bf:0c:fb:39:d2:5d:a2:8f:73:37:f1:f3:e0:a4:f9</font></p><p class="MsoNormal"><font color="#1f497d"><br></font></p><p class="MsoNormal"><font color="#1f497d">List of X.509 CA Certificates</font></p><p class="MsoNormal"><font color="#1f497d"><br></font></p><p class="MsoNormal"><font color="#1f497d"> subject: "C=US, O=CableLabs, OU=TEST Device CA01, CN=TEST CableLabs Device Certification Authority"</font></p><p class="MsoNormal"><font color="#1f497d"> issuer: "C=US, O=CableLabs, OU=TEST Root CA01, CN=TEST CableLabs Root Certification Authority"</font></p><p class="MsoNormal"><font color="#1f497d"> validity: not before Dec 09 23:08:49 2014, ok</font></p><p class="MsoNormal"><font color="#1f497d"> not after Dec 09 23:08:49 2049, ok (expires in 11755 days)</font></p><p class="MsoNormal"><font color="#1f497d"> serial: a0:16:bc:73:85:0e:65:37</font></p><p class="MsoNormal"><font color="#1f497d"> altNames: CN=SYMC-3072-5</font></p><p class="MsoNormal"><font color="#1f497d"> flags: CA CRLSign </font></p><p class="MsoNormal"><font color="#1f497d"> pathlen: 0</font></p><p class="MsoNormal"><font color="#1f497d"> authkeyId: 89:62:79:3d:b4:07:c9:f3:c6:97:59:dd:b6:dc:65:0b:33:54:ff:fb</font></p><p class="MsoNormal"><font color="#1f497d"> subjkeyId: f6:dc:40:8a:89:b6:7b:7a:08:f6:78:b5:4a:28:7a:7f:57:9b:f9:9b</font></p><p class="MsoNormal"><font color="#1f497d"> pubkey: RSA 3072 bits</font></p><p class="MsoNormal"><font color="#1f497d"> keyid: b7:98:32:e4:ae:30:02:57:f7:ad:cb:2b:37:41:17:9c:1b:9d:79:28</font></p><p class="MsoNormal"><font color="#1f497d"> subjkey: f6:dc:40:8a:89:b6:7b:7a:08:f6:78:b5:4a:28:7a:7f:57:9b:f9:9b</font></p><p class="MsoNormal"><font color="#1f497d"><br></font></p><p class="MsoNormal"><font color="#1f497d"> subject: "C=US, O=CableLabs, OU=TEST Root CA01, CN=TEST CableLabs Root Certification Authority"</font></p><p class="MsoNormal"><font color="#1f497d"> issuer: "C=US, O=CableLabs, OU=TEST Root CA01, CN=TEST CableLabs Root Certification Authority"</font></p><p class="MsoNormal"><font color="#1f497d"> validity: not before Nov 11 17:19:44 2014, ok</font></p><p class="MsoNormal"><font color="#1f497d"> not after Nov 11 17:19:44 2064, ok (expires in 17206 days)</font></p><p class="MsoNormal"><font color="#1f497d"> serial: b1:b0:d3:be:83:ee:bf:e3</font></p><p class="MsoNormal"><font color="#1f497d"> altNames: CN=MPKI-4096-1-206</font></p><p class="MsoNormal"><font color="#1f497d"> flags: CA CRLSign self-signed </font></p><p class="MsoNormal"><font color="#1f497d"> subjkeyId: 89:62:79:3d:b4:07:c9:f3:c6:97:59:dd:b6:dc:65:0b:33:54:ff:fb</font></p><p class="MsoNormal"><font color="#1f497d"> pubkey: RSA 4096 bits</font></p><p class="MsoNormal"><font color="#1f497d"> keyid: bd:0e:4c:0f:21:cf:f0:49:af:19:34:3b:c2:64:c5:31:a1:2e:11:07</font></p><p class="MsoNormal"><font color="#1f497d"></font></p><p class="MsoNormal"><font color="#1f497d"> subjkey: 89:62:79:3d:b4:07:c9:f3:c6:97:59:dd:b6:dc:65:0b:33:54:ff:fb</font></p><p class="MsoNormal"><font color="#1f497d"><br></font></p><p class="MsoNormal"><font color="#1f497d"><br></font></p><p class="MsoNormal"><font color="#1f497d">pki --print --type rsa-priv --in privKey.pem</font></p><p class="MsoNormal"><font color="#1f497d"> privkey: RSA 2048 bits</font></p><p class="MsoNormal"><font color="#1f497d"> keyid: 8d:40:7d:fb:38:7b:4b:e2:fe:00:ba:72:6c:82:63:2b:6b:75:30:6e</font></p><p class="MsoNormal"><font color="#1f497d"></font></p><p class="MsoNormal"><font color="#1f497d"> subjkey: 9d:c7:c5:20:f7:bf:0c:fb:39:d2:5d:a2:8f:73:37:f1:f3:e0:a4:f9</font></p><p class="MsoNormal"><font color="#1f497d"><br></font></p></div></div>