[strongSwan] Reread of CA certificates, CRL checking
Andreas Steffen
andreas.steffen at strongswan.org
Fri Feb 26 22:14:24 CET 2010
Hello Markus,
could you send me the sales end entity and ca certificates as well
as the CRL?
Regards
Andreas
Markus Müller wrote:
> Hello,
>
> I've got the following 2 questions about a strongSwan 4.3.6 setup with
> OpenSSL 0.9.8g certificates:
>
> 1)
> Is there a way to tell the pluto & charon daemons to "forget" removed CA
> certificates from /etc/ipsec.d/cacerts without a restart
> (and thus disrupted connections)?
> When I delete a certificate from the folder and run 'ipsec rereadcacerts',
> the removed certificate is still listed in the 'ipsec listcacerts' output.
>
> 2)
> I generated CRLs for my CAs and put those in the /etc/ipsec.d/crls folder.
> One of the CRLs belongs to a CA with a revoked certificate.
> When I tried to connect, using that revoked certificate, I got connected
> when keyexchange is set to ikev2 and rejected (as expected) when
> keyexchange is set to ike.
>
> Thanks in advance,
> Markus
>
>
> The ipsec.conf files look like this:
>
> gateway side:
> conn 1
> left=192.168.150.135
> leftsubnet=172.16.121.0/24
> right=%any
> authby=rsasig
> leftcert=cert1.pem
> leftid="C=de, ST=state, O=company, OU=develop, CN=cert 1, E=dev at company.de"
> rightid=%any
> dpdaction=hold
> dpddelay=15s
> ike=aes256-sha2_512-modp8192,aes256-sha2_512-modp4096!
> esp=aes256-sha2_256!
> keyexchange=ikev2
> ikelifetime=3600s
> keyingtries=%forever
> keylife=300s
> rekey=yes
> rekeymargin=60s
> rekeyfuzz=50%
> reauth=yes
> auto=add
> leftsendcert=ifasked
>
> client side:
> conn 1
> left=192.168.150.136
> right=192.168.150.135
> rightsubnet=172.16.121.0/24
> authby=rsasig
> leftcert=cert2.pem
> leftid="C=de, ST=state, O=company, OU=sales, CN=cert 2, E=sales at company.de"
> rightcert=cert1.pem
> rightid="C=de, ST=state, O=company, OU=develop, CN=cert 1, E=dev at company.de"
> dpdaction=hold
> dpddelay=15s
> ike=aes256-sha2_512-modp8192,aes256-sha2_512-modp4096!
> esp=aes128-sha2_256,aes256-sha2_256!
> keyexchange=ikev2
> ikelifetime=3600s
> keyingtries=%forever
> keylife=300s
> rekey=yes
> rekeymargin=60s
> rekeyfuzz=50%
> reauth=yes
> auto=add
> leftsendcert=ifasked
>
> 'ipsec listcrls' output on gateway side:
> 000
> 000 List of X.509 CRLs:
> 000
> 000 issuer: "C=de, ST=state, L=city, O=company, OU=sales,
> CN=sales ca, E=sales at company.de"
> 000 revoked: 1 certificates
> 000 distPts: 'file:///etc/ipsec.d/crls/sales_crl.pem'
> 000 updates: this Feb 23 13:31:38 2010
> 000 next Feb 21 13:31:38 2020 ok
> 000
> 000 issuer: "C=de, ST=state, L=city, O=company, OU=develop,
> CN=develop ca, E=dev at company.de"
> 000 revoked: 0 certificates
> 000 distPts: 'file:///etc/ipsec.d/crls/develop_crl.pem'
> 000 updates: this Jan 22 14:53:53 2010
> 000 next Jan 20 14:53:53 2020 ok
>
> List of X.509 CRLs:
>
> issuer: "C=de, ST=state, L=city, O=company, OU=sales, CN=sales
> ca, E=sales at company.de"
> revoked: 1 certificate
> updates: this Feb 23 13:31:38 2010
> next Feb 21 13:31:38 2020, ok
>
> issuer: "C=de, ST=state, L=city, O=company, OU=develop,
> CN=develop ca, E=dev at company.de"
> revoked: 0 certificates
> updates: this Jan 22 14:53:53 2010
> next Jan 20 14:53:53 2020, ok
>
> log on gateway side (ikev2):
> s_local@(none) charon: 11[CFG] selected peer config '1'
> s_local@(none) charon: 11[CFG] using certificate "C=de, ST=state,
> O=company, OU=sales, CN=cert 2, E=sales at company.de"
> s_local@(none) charon: 11[CFG] using trusted ca certificate
> "C=de, ST=state, L=city, O=company, OU=sales, CN=sales ca,
> E=sales at company.de"
> s_local@(none) charon: 11[CFG] checking certificate status of
> "C=de, ST=state, O=company, OU=sales, CN=cert 2, E=sales at company.de"
> s_local@(none) charon: 11[CFG] certificate status is not available
> s_local@(none) charon: 11[CFG] reached self-signed root ca with a
> path length of 0
> s_local@(none) charon: 11[IKE] authentication of 'C=de, ST=state,
> O=company, OU=sales, CN=cert 2, E=sales at company.de' with RSA signature
> successful
>
> log on gateway side (ikev1):
> "1"[1] 192.168.150.136 #3: responding to Main Mode from unknown
> peer 192.168.150.136
> "1"[1] 192.168.150.136 #3: Peer ID is ID_DER_ASN1_DN: 'C=de,
> ST=state, O=company, OU=sales, CN=cert 2, E=sales at company.de'
> "1"[1] 192.168.150.136 #3: certificate was revoked on Feb 23
> 13:30:46 UTC 2010, reason: unspecified
> "1"[1] 192.168.150.136 #3: X.509 certificate rejected
> "1"[1] 192.168.150.136 #3: no public key known for 'C=de, ST=state,
> O=company, OU=sales, CN=cert 2, E=sales at company.de'
> "1"[1] 192.168.150.136 #3: sending encrypted notification
> INVALID_KEY_INFORMATION to 192.168.150.136:500
======================================================================
Andreas Steffen andreas.steffen at strongswan.org
strongSwan - the Linux VPN Solution! www.strongswan.org
Institute for Internet Technologies and Applications
University of Applied Sciences Rapperswil
CH-8640 Rapperswil (Switzerland)
===========================================================[ITA-HSR]==
More information about the Users
mailing list