<html><head></head><body><div class="yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;"><div dir="ltr" data-setdir="false">Hi Strongswan users!</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">This is my first post. I have problems to use ECDSA </div><div dir="ltr" data-setdir="false">certificates with strongswan (did not have problems with</div><div dir="ltr" data-setdir="false">RSA certificates).</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">Please help to solve this problem. Thanks.</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">ipsec.conf file </div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false"><div><div>conn ss_as_init_cert_x2_22685</div><div> left=172.16.58.97 </div><div> leftid=Userikev2-A </div><div> leftsubnet=172.16.58.93/32</div><div> #leftsourceip=%config </div><div> leftfirewall=yes </div><div> leftauth=pubkey </div><div> leftcert=user-cert-ikev2-A.pem</div><div> keyingtries=2 </div><div> reauth=no </div><div> right=172.16.58.96 </div><div> rightauth=pubkey </div><div> rightid=%any</div><div> rightsubnet=172.16.58.96/32</div><div> auto=add</div><div> ike=aes256-sha512-modp2048!</div><div> keyexchange=ikev2</div><div> type=tunnel</div><div> esp=aes256-sha512-modp2048!</div><div> ikelifetime=60m</div><div> lifetime=30m</div><div> margintime=1s</div><div> rekey=yes</div><div> dpdaction=none</div><div> dpddelay=300s</div><div> dpdtimeout=10s</div><div> mobike=no</div><div><br></div></div><br></div><div dir="ltr" data-setdir="false">Certificate:</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false"><div><div dir="ltr" data-setdir="false"><div><div> Data:</div><div> Version: 3 (0x2)</div><div> Serial Number: 4 (0x4)</div><div> Signature Algorithm: ecdsa-with-SHA1</div><div> Issuer: C=US, ST=Massachusetts, L=Bedford, O=acmepacket, CN=root/emailAddress=tester@acmepacket.com</div><div> Validity</div><div> Not Before: Nov 5 18:16:38 2020 GMT</div><div> Not After : May 24 18:16:38 2021 GMT</div><div> Subject: C=US, ST=Massachusetts, O=acmepacket.com, CN=Userikev2-A/emailAddress=userikev2-A@acmepacket.com</div><div> Subject Public Key Info:</div><div> Public Key Algorithm: id-ecPublicKey</div><div> Public-Key: (256 bit)</div><div> pub:</div><div> 04:36:43:df:ab:7a:1e:e4:33:7e:da:4c:da:42:67:</div><div> 02:1c:3b:d0:ef:33:91:95:45:84:50:2d:34:b6:6f:</div><div> 20:79:3e:a1:82:e6:e4:98:b3:56:cb:7a:b8:f3:c9:</div><div> ff:0e:8c:33:a9:90:e4:55:9f:c9:28:4d:f5:15:2f:</div><div> d0:78:ab:94:d8</div><div> ASN1 OID: prime256v1</div><div> X509v3 extensions:</div><div> X509v3 Basic Constraints:</div><div> CA:FALSE</div><div> X509v3 Subject Key Identifier:</div><div> 23:36:62:1F:64:ED:C1:45:34:8D:52:C5:07:3C:68:AE:7F:92:8F:DE</div><div> X509v3 Authority Key Identifier:</div><div> keyid:1D:6A:76:68:32:A7:3B:48:35:6C:F1:3F:76:7A:06:12:F2:51:0A:2E</div><div> DirName:/C=US/ST=Massachusetts/L=Bedford/O=acmepacket/CN=root/emailAddress=tester@acmepacket.com</div><div> serial:BD:52:8A:11:94:74:C2:20</div><div><br></div><div> X509v3 Key Usage:</div><div> Digital Signature, Key Encipherment</div><div> X509v3 Issuer Alternative Name:</div><div> DNS:abc.com</div><div> X509v3 Subject Alternative Name:</div><div> DNS:abc.com</div><div> Signature Algorithm: ecdsa-with-SHA1</div><div> 30:45:02:21:00:f0:9e:68:b6:18:9a:aa:93:56:ad:74:80:d1:</div><div> 2b:ce:9f:85:12:1b:19:17:ef:b2:10:d0:c4:14:28:18:42:79:</div><div> 15:02:20:5d:32:32:bd:02:98:c2:28:9e:c9:10:5c:06:36:e7:</div><div> 6d:37:5e:2c:f5:97:96:6b:54:e4:3d:63:59:8e:cb:95:d6</div><div><br></div></div><br></div><div><br></div><div dir="ltr" data-setdir="false">Private Key:</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false"><div><div>read EC key</div><div>Private-Key: (256 bit)</div><div>priv:</div><div> 7b:7b:d0:11:9c:57:bc:86:2e:e9:29:d8:a1:54:a1:</div><div> 32:bd:c4:4b:79:a2:ac:23:4e:7f:3e:16:88:47:4e:</div><div> f7:29</div><div>pub:</div><div> 04:36:43:df:ab:7a:1e:e4:33:7e:da:4c:da:42:67:</div><div> 02:1c:3b:d0:ef:33:91:95:45:84:50:2d:34:b6:6f:</div><div> 20:79:3e:a1:82:e6:e4:98:b3:56:cb:7a:b8:f3:c9:</div><div> ff:0e:8c:33:a9:90:e4:55:9f:c9:28:4d:f5:15:2f:</div><div> d0:78:ab:94:d8</div><div>ASN1 OID: prime256v1</div><div>writing EC key</div><div>-----BEGIN EC PRIVATE KEY-----</div><div>MHcCAQEEIHt70BGcV7yGLukp2KFUoTK9xEt5oqwjTn8+FohHTvcpoAoGCCqGSM49</div><div>AwEHoUQDQgAENkPfq3oe5DN+2kzaQmcCHDvQ7zORlUWEUC00tm8geT6hgubkmLNW</div><div>y3q488n/DowzqZDkVZ/JKE31FS/QeKuU2A==</div><div>-----END EC PRIVATE KEY-----</div><div><br></div></div><br></div><div dir="ltr" data-setdir="false">IPSEC Secerts file</div><div dir="ltr" data-setdir="false"><div><div><br></div><div>: ECDSA user-key-ikev2-A.pem</div><div>: ECDSA user-key-ikev2-B.pem</div><div><br></div></div><br></div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">CHARON OUTPUT</div></div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false"><div><div>feature PUBKEY:ECDSA in plugin 'pem' has unmet dependency: PUBKEY:ECDSA</div><div>Nov 5 13:57:19 00[LIB] feature PUBKEY:DSA in plugin 'pem' has unmet dependency: PUBKEY:DSA</div><div>Nov 5 13:57:19 00[LIB] feature PRIVKEY:DSA in plugin 'pem' has unmet dependency: PRIVKEY:DSA</div><div>Nov 5 13:57:19 00[LIB] feature PRIVKEY:BLISS in plugin 'pem' has unmet dependency: PRIVKEY:BLISS</div><div>Nov 5 13:57:19 00[LIB] feature CERT_DECODE:X509_OCSP_REQUEST in plugin 'pem' has unmet dependency: CERT_DECODE:X509_OCSP_REQUEST</div><div>Nov 5 13:57:19 00[LIB] feature PRF:PRF_CAMELLIA128_XCBC in plugin 'xcbc' has unmet dependency: CRYPTER:CAMELLIA_CBC-16</div><div>Nov 5 13:57:19 00[LIB] feature SIGNER:CAMELLIA_XCBC_96 in plugin 'xcbc' has unmet dependency: CRYPTER:CAMELLIA_CBC-16</div><div>Nov 5 13:57:19 00[CFG] loading ca certificates from '/usr/local/etc/ipsec.d/cacerts'</div><div>Nov 5 13:57:19 00[ASN] file content is not binary ASN.1</div><div>Nov 5 13:57:19 00[ASN] -----BEGIN CERTIFICATE-----</div><div>Nov 5 13:57:19 00[ASN] -----END CERTIFICATE-----</div><div>Nov 5 13:57:19 00[ASN] L0 - x509:</div><div>Nov 5 13:57:19 00[ASN] L1 - tbsCertificate:</div><div>Nov 5 13:57:19 00[ASN] L2 - DEFAULT v1:</div><div>Nov 5 13:57:19 00[ASN] L3 - version:</div><div>Nov 5 13:57:19 00[ASN] X.509v3</div><div>Nov 5 13:57:19 00[ASN] L2 - serialNumber:</div><div><br></div></div>Thank you.</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">Rouben</div><br></div></div></body></html>