[strongSwan] Unable to establish ipsec tunnel using certs of intermediate CA's

Tue Mar 4 14:19:54 CET 2014

Hi Sriram, could you post the output of the command

   ipsec listcacerts

both on  10.206.1.10 and 10.206.1.11. This shows if the intermediate
CA certificates have been successfully loaded.

Regards

Andreas

On 04.03.2014 12:45, Sriram wrote:
> Hi Everyone,
>
> I have host –to-host ipsec setup between 2 ips 10.206.1.10 and 10.206.1.11
>
> Tunnel is established using certificates. Tunnel is established
> properly, when the certificates are generated using rootca.
>
> But when the certificates are generated using intermediate CA’s, tunnel
> is not getting established.
>
> In 10.206.1.10
>
> Under /etc/ipsec.d/cacerts/ I have copied ca.crt(root ca),
> *ca-int.crt(Intermediate ca)*
>
> In /etc/ipsec.d/certs/ I have copied end entity cert issued by ca-int.crt
>
> In 10.206.1.11
>
> Under /etc/ipsec.d/cacerts/ I have copied ca.crt(root ca),
> *ca-int1.crt(Intermediate ca)*
>
> In /etc/ipsec.d/certs/ I have copied end entity cert issued by ca-int1.crt
>
> I am getting below errors
>
> Mar3 19:34:45 localhost charon: 06[ENC] parsed IKE_AUTH request 1 [ IDi
> CERT N(INIT_CONTACT) CERTREQ IDr AUTH CPRQ(ADDR) SA TSi TSr N(MULT_AUTH)
> N(EAP_ONLY) ]
>
> Mar3 19:34:45 localhost charon: 06[IKE] received cert request for
> "CN=DaRoot"
>
> Mar3 19:34:45 localhost charon: 06[IKE] received end entity cert
> "CN=1234abcd"
>
> Mar3 19:34:45 localhost charon: 06[CFG] looking for peer configs
> matching 10.206.1.11[CN=12345abcde]...10.206.1.10[CN=1234abcd]
>
> Mar3 19:34:45 localhost charon: 06[CFG] peer config match local: 20
> (ID_DER_ASN1_DN ->
> 30:15:31:13:30:11:06:03:55:04:03:13:0a:31:32:33:34:35:61:62:63:64:65)
>
> Mar3 19:34:45 localhost charon: 06[CFG] peer config match remote: 20
> (ID_DER_ASN1_DN ->
> 30:13:31:11:30:0f:06:03:55:04:03:13:08:31:32:33:34:61:62:63:64)
>
> Mar3 19:34:45 localhost charon: 06[CFG] ike config match: 3100
> (10.206.1.11 10.206.1.10 IKEv2)
>
> Mar3 19:34:45 localhost charon: 06[CFG]candidate "home1", match:
> 20/20/3100 (me/other/ike)
>
> Mar3 19:34:45 localhost charon: 06[CFG] selected peer config 'home1'
>
> Mar3 19:34:45 localhost charon: 06[IKE] IDx' => 25 bytes @ 0xb4d82fe0
>
> Mar3 19:34:45 localhost charon: 06[IKE]0: 09 00 00 00 30 13 31 11 30 0F
> 06 03 55 04 03 13....0.1.0...U...
>
> Mar3 19:34:45 localhost charon: 06[IKE]16: 08 31 32 33 34 61 62 63
> 64.1234abcd
>
> Mar3 19:34:45 localhost charon: 06[IKE] SK_p => 16 bytes @ 0x91c5340
>
> Mar3 19:34:45 localhost charon: 06[IKE]0: 43 85 1F D8 CA 8B BD 27 A0 58
> B8 9F 18 5C E7 C0C......'.X...\..
>
> Mar3 19:34:45 localhost charon: 06[IKE] octets = message + nonce +
> prf(Sk_px, IDx') => 316 bytes @ 0x91c6d88
>
> Mar3 19:34:45 localhost charon: 06[IKE]0: 95 B5 C1 A2 8D 13 C3 77 00 00
> 00 00 00 00 00 00.......w........
>
> Mar3 19:34:45 localhost charon: 06[IKE]16: 21 20 22 08 00 00 00 00 00 00
> 01 0C 22 00 00 2C! "........."..,
>
> Mar3 19:34:45 localhost charon: 06[IKE]32: 00 00 00 28 01 01 00 04 03 00
> 00 08 01 00 00 03...(............
>
> Mar3 19:34:45 localhost charon: 06[IKE]48: 03 00 00 <tel:03%2000%2000>
> 08 03 00 00 01 03 00 00 08 02 00 00 01................
>
> Mar3 19:34:45 localhost charon: 06[IKE]64: 00 00 00 08 04 00 00 01 28 00
> 00 68 00 01 00 00........(..h....
>
> Mar3 19:34:45 localhost charon: 06[IKE]80: 23 F4 AC E7 E8 4E 55 80 54 B7
> 14 C8 48 B9 98 AE#....NU.T...H...
>
> Mar3 19:34:45 localhost charon: 06[IKE]96: 15 DB CA F8 93 BF 31 2D 59 89
> 77 52 32 A8 0A 2D......1-Y.wR2..-
>
> Mar3 19:34:45 localhost charon: 06[IKE]112: 78 3E 6F EB 6D 33 5A E6 A5
> B7 0F 9A 3C DA 4E D8x>o.m3Z.....<.N.
>
> Mar3 19:34:45 localhost charon: 06[IKE]128: E6 71 B4 C4 5A D7 20 48 61
> B2 34 14 99 0A F6 AF.q..Z. Ha.4.....
>
> Mar3 19:34:45 localhost charon: 06[IKE]144: F8 DB 6D 82 B2 55 6C 1B 84
> CA 37 8E C3 7F 50 8A..m..Ul...7...P.
>
> Mar3 19:34:45 localhost charon: 06[IKE]160: 5C 2A 39 E4 27 FC 8D 23 38
> 95 E2 B2 F3 F9 8E CA\*9.'..#8.......
>
> Mar3 19:34:45 localhost charon: 06[IKE]176: 29 00 00 24 03 8D 56 09 5D
> B1 17 D2 BA 29 D6 8B)..$..V.]....)..
>
> Mar3 19:34:45 localhost charon: 06[IKE]192: 7E 0B A5 2D 42 4C 1D 37 D9
> EA 17 4A 0D 0C 77 67~..-BL.7...J..wg
>
> Mar3 19:34:45 localhost charon: 06[IKE]208: E6 51 40 1D 29 00 00 1C 00
> 00 40 04 D5 2F E3 7F.Q at .)..... at ../..
>
> Mar3 19:34:45 localhost charon: 06[IKE]224: 13 80 F3 7A 91 9D F2 7A 0A
> 6E C0 A9 E7 B2 72 63...z...z.n....rc
>
> Mar3 19:34:45 localhost charon: 06[IKE]240: 00 00 00 1C 00 00 40 05 BD
> B4 3E 98 F1 EB F4 10...... at ...>.....
>
> Mar3 19:34:45 localhost charon: 06[IKE]256: 44 06 6B 25 90 C4 30 CF BB
> FB FE 4C 00 9B 1E ADD.k%..0....L....
>
> Mar3 19:34:45 localhost charon: 06[IKE]272: 19 7A F6 43 23 A9 8A C4 3C
> EF 98 57 13 69 07 0E.z.C#...<..W.i..
>
> Mar3 19:34:45 localhost charon: 06[IKE]288: 9A E4 34 F1 A6 9B 48 65 E8
> 06 8A 6C 6D 30 6B C1..4...He...lm0k.
>
> Mar3 19:34:45 localhost charon: 06[IKE]304: F2 2C 6E 19 39 37 C1 C6 2F
> 48 D2 18.,n.97../H..
>
> Mar3 19:34:45 localhost charon: 06[CFG]using certificate "CN=1234abcd"
>
> Mar3 19:34:45 localhost charon: 06[CFG]certificate "CN=1234abcd" key:
> 2048 bit RSA
>
> *Mar3 19:34:45 localhost charon: 06[CFG] no issuer certificate found for
> "CN=1234abcd"*
>
> Mar3 19:34:45 localhost charon: 06[IKE] no trusted RSA public key found
> for 'CN=1234abcd'
>
> Mar3 19:34:45 localhost charon: 06[IKE] processing INTERNAL_IP4_ADDRESS
> attribute
>
> Please let me know, how to resolve this issue.
>
> Below post suggests that the intermediate certs need to be sent along
> with the end-entity certificates in ike_auth message.
>
> If that can solve the issue, how can I achieve that.
>
> https://lists.strongswan.org/pipermail/users/2013-March/008956.html
>
> Any help in this regard is appreciated.
>
> Regards,
>
> Sriram.
>
>
>
>
>
>
> _______________________________________________
> Users mailing list
> Users at lists.strongswan.org
> https://lists.strongswan.org/mailman/listinfo/users
>

-- 
======================================================================
Andreas Steffen                         andreas.steffen at strongswan.org
strongSwan - the Open Source VPN Solution!          www.strongswan.org
Institute for Internet Technologies and Applications
University of Applied Sciences Rapperswil
CH-8640 Rapperswil (Switzerland)
===========================================================[ITA-HSR]==

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4255 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://lists.strongswan.org/pipermail/users/attachments/20140304/c29253d7/attachment.bin>