[strongSwan] [Strongswan]expected hash algorithm HASH_SHA1, but found HASH_SHA256 error

SaRaVanAn saravanan.nagarajan87 at gmail.com
Wed Aug 22 08:46:05 CEST 2012


Hi,
   I am trying to form a tunnel using RSA authentication in Strongswan with
CISCO as peer, but
I am getting the below error message.

Aug 22 12:03:34 uxcasxxx charon: 08[CFG] selected peer config 'site-site'
Aug 22 12:03:34 uxcasxxx charon: 08[CFG]   using certificate "C=IN, O=CAS"
Aug 22 12:03:34 uxcasxxx charon: 08[CFG]   using trusted ca certificate
"C=IN, ST=TN, L=CH, O=CAS, E=saravanan at strongswan.org"
Aug 22 12:03:34 uxcasxxx charon: 08[CFG] checking certificate status of
"C=IN, O=CAS"
Aug 22 12:03:34 uxcasxxx charon: 08[CFG] certificate status is not available
Aug 22 12:03:34 uxcasxxx charon: 08[CFG]   reached self-signed root ca with
a path length of 0
*Aug 22 12:03:34 uxcasxxx charon: 08[LIB] expected hash algorithm
HASH_SHA1, but found HASH_SHA256 (OID:
30:0d:06:09:60:86:48:01:65:03:04:02:01:05:00)*
Aug 22 12:03:34 uxcasxxx charon: 08[IKE] signature validation failed,
looking for another key
Aug 22 12:03:34 uxcasxxx charon: 08[ENC] generating IKE_AUTH response 1 [
N(AUTH_FAILED) ]

Please find my configurations below .

ca vpnca
         cacert=ikeca_email.crt
         auto=add

config setup
          plutostart=yes
          plutodebug=all
          charonstart=yes
          charondebug=all
          nat_traversal=yes
          crlcheckinterval=10m
          strictcrlpolicy=no

conn %default
        ikelifetime=8h
        lifetime = 8h
        rekeyfuzz = 100%
        keyingtries=1

conn site-site
    left=172.31.114.227
    leftcert=LeftGty_email.crt
    ike=aes128-sha256-modp1536!
    esp=aes128-sha256!
    leftid=carol at strongswan.org
    rightsubnet=0.0.0.0/0
    leftfirewall=yes
    right=%any
    rightid=saravanan at strongswan.org
    keyexchange=ikev2
    auto=add

ipsec.secrets
: RSA LeftGty_email.key

I am suspecting the problem in configurations.If so, please help me to
correct the configuration or else
what could be the reason for the failure?.

Regards,
Saravanan N
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.strongswan.org/pipermail/users/attachments/20120822/c03a2a1f/attachment.html>


More information about the Users mailing list