<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=windows-1252">
</head>
<body>
<p>Hi, people.</p>
<p>I've a private CA based on Ubuntu 12 (OpenSSL 1.0.2h 3 May 2016)
wich generates certificates for our roadwarriors (mostly Ubuntu 18
and windows 10) and works well. Certs are generated using CA.pl
from openssl package. <br>
</p>
<p>I've been trying to migrate the CA to a Debian 10 (OpenSSL
1.1.1d 10 Sep 2019) but private key generated in it are
unreadable by strongswan in roadwarriors (Ubuntu 18, Strongswan
5.6.2-1ubuntu2, OpenSSL 1.1.1 11 Sep 2018). May be
stronger/different ciphers?. For example:</p>
<p>a) With original CA generated key and cert:<br>
</p>
<p><a class="moz-txt-link-abbreviated" href="mailto:root@ubuntu:/etc/ipsec.d/private#">root@ubuntu:/etc/ipsec.d/private#</a> pki --print -t rsa -i
mper.key.pem <br>
Private key passphrase: <br>
privkey: RSA 2048 bits<br>
keyid: 51:....<br>
subjkey: 63:........<br>
</p>
<p>b) With new CA generated key and cert:</p>
<p><a class="moz-txt-link-abbreviated" href="mailto:root@ubuntu:/etc/ipsec.d/private#">root@ubuntu:/etc/ipsec.d/private#</a> pki --print -t rsa -i
lmar.key.pem <br>
Private key passphrase: <br>
building CRED_PRIVATE_KEY - RSA failed, tried 9 builders<br>
parsing input failed</p>
<p>but openssl in the same roadwarrior, shows key info pretty well:<br>
</p>
<p><a class="moz-txt-link-abbreviated" href="mailto:root@ubuntu:/etc/ipsec.d/private#">root@ubuntu:/etc/ipsec.d/private#</a> openssl rsa -in lmar.key.pem
-noout -text<br>
Enter pass phrase for lmar.key.pem:<br>
RSA Private-Key: (2048 bit, 2 primes)<br>
modulus:<br>
00:c4:32:1c:64:96:70:8c:a6:16:6f:33:57:4c:7d:..........</p>
<p>c) In a roadwarrior Debian 10 based (strongswan 5.7.2-1). The key
which fails in Ubuntu 18 is readed ok.<br>
</p>
<p>root@sisftossrv:/home/sistemas# pki --print -t rsa -i
lmar.key.pem <br>
Private key passphrase: <br>
privkey: RSA 2048 bits<br>
keyid: 8a:.....<br>
subjkey: 7f:.....<br>
<br>
</p>
<p>Can you help me?. Is it possible my versions mix or is
impractical to have my CA in Debian 10?. <br>
</p>
<p>Thanks in advance. Best regards.</p>
<p>Iván<br>
</p>
</body>
</html>