[strongSwan] Strongswan VPN with CA
noel.kuntze+strongswan-users-ml at thermi.consulting
Wed May 16 14:22:52 CEST 2018
PS: Alternatively, the signature the other peer sent with the message is incorrect. Maybe Tobias or Andreas can explain what exactly is the problem here.
On 16.05.2018 14:20, Noel Kuntze wrote:
> Hello Phil,
> No, that's not the problem. It's because the CA screwed up the settings of the X509 policy mapping extension. I don't quite know the details of /what/ they got wrong, but as far as I can tell,
> the CA certificate is either missing the extension value that allows any policy or has INHIBIT_ANY_POLICY set.
> Kind regards
> On 16.05.2018 14:10, Phil Frost wrote:
>> It doesn't appear you've configured strongswan to trust any CAs anywhere. See /etc/ipsec.d/cacerts, the "CA SECTIONS" section in ipsec.conf(5), and the leftca and rightca options.
>> On Wed, May 16, 2018 at 9:40 AM Michal Grzelak <michal.grzelak at nordcloud.com <mailto:michal.grzelak at nordcloud.com>> wrote:
>> I have a Site to Site VPN between Strongswan and Cisco working over PSK. Wanted to upgrade it to authenticate via Certificates, but can't get it done. Receiving following error:
>> |May 9 13:57:20 strongswan charon: 13[CFG] ocsp response correctly signed by "C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., CN=Go Daddy Root Validation Authority - G2" May 9 13:57:20 strongswan charon: 13[CFG] ocsp response is valid: until May 11 01:05:00 2018 May 9 13:57:20 strongswan charon: 13[CFG] using cached ocsp response May 9 13:57:20 strongswan charon: 13[CFG] certificate status is good May 9 13:57:20 strongswan charon: 13[CFG] certificate policy 2.16.840.1.1144184.108.40.206.1 for 'OU=Domain Control Validated, CN=hostname.somedomain.com <http://hostname.somedomain.com>' not allowed by trustchain, ignored May 9 13:57:20 strongswan charon: 13[CFG] certificate policy 220.127.116.11.2.1 for 'OU=Domain Control Validated, CN=hostname.somedomain.com <http://hostname.somedomain.com>' not allowed by trustchain, ignored May 9 13:57:20 strongswan charon: 13[CFG] reached self-signed root ca with a path length of 1 May 9 13:57:20 strongswan charon: 13[IKE] signature
>> validation failed, looking for another key |
>> The Certificates for both ends are signed by two different CA, but already exchanged public root and intermediate certs. On cisco side I see the tunnel goes up for both Phase 1 and 2, so its good. Strongswan has problem with it and no SA is up.
>> |conn testconn auto=start left=%any leftfirewall=yes firstname.lastname@example.org <http://strongswan.mydomain.com> leftid=x.x.x.x leftcert=strongswan.mydomain.com.pem right=y.y.y.y rightid=%any email@example.com <http://hostname.somedomain.com> type=tunnel ikelifetime=24h keylife=1h esp=aes256-sha384-ecp521 ike=aes256-sha384-modp1024 keyingtries=%forever keyexchange=ikev2 leftsubnet=z.z.z.z/z rightsubnet=u.u.u.u/u dpddelay=10s dpdtimeout=30s dpdaction=restart |
>> What be wrong here? Any suggestions?
>> Best regards,
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: OpenPGP digital signature
More information about the Users