[strongSwan] RSA_EMSA_PKCS1_SHA1 not acceptable

Tobias Brunner tobias at strongswan.org
Mon Mar 19 11:16:06 CET 2018

Hi Mike,

> Did you find something that could help us?

You gave the answer basically yourself by considering the very old
strongSwan version (which you claimed to be 5.5.3 on both ends in your
original mail btw.).  If you didn't stop there but e.g. checked the
changelog [1] to see since when IKEv2 signature authentication (and thus
the use of stronger signature algorithms) has been supported (it's
5.3.0) you'd have realized that you can't restrict the signature
algorithm to only SHA-256 during authentication (rightauth) if your
peers use such old versions that only support SHA-1.

> The client has the same configuration as the gateway:
>    ike=aes256-sha256-modp2048,aes256-sha1-modp2048!
>    esp=aes256-sha256-modp2048,aes256-sha1-modp2048!

This has absolutely nothing to do with the authentication, where your
problem is.



More information about the Users mailing list