[Swan] Trying to troubleshhot IPSec connection with certificates
Bob Miller
bob at computerisms.ca
Mon Feb 1 23:45:22 UTC 2016
Hi Noam,
just a few things you can check:
ipsec verify (all ok?)
ipsec auto --listall (certificates from both sides are loaded on both
sides?)
certutil -L -d sql:/etc/ipsec.d/ (certs and CA listed?)
not sure what your setup, but in your conn you are using subnets instead
of subnet, there is no rightcert or rightrsasigkey, and for left/rightid
you can try @certfriendlyname
>> ----------------------------
>> conn connST603
>> authby = rsasig
>> auto = start
>> dpdaction = restart
>> dpddelay = 30
>> dpdtimeout = 120
>> esp = aes128-sha1
>> forceencaps = yes
>> ike = aes128-sha1
>> ikelifetime = 86400s
>> left = %defaultroute
>> leftcert = globalCertificate
>> leftid = 54.194.188.148
>> leftrsasigkey = %cert
>> leftsubnets = 172.24.128.0/24 <http://172.24.128.0/24>
>> lifetime = 28800s
>> pfs = no
>> right = 54.194.210.197
>> rightid = 54.194.210.197
>> rightsubnets = 172.24.131.0/24 <http://172.24.131.0/24>
>> type = tunnel
>>
>> ** I also tried using leftid="CN=...", but got similar results
>> The certificates look fine to me
>>
>> The signed certificate:
>> -----------------------
>> openssl x509 -text -noout -in /etc/xxx/globalCertificate.pem
>> Certificate:
>> Data:
>> Version: 3 (0x2)
>> Serial Number: 1 (0x1)
>> Signature Algorithm: sha256WithRSAEncryption
>> Issuer: CN=noamPlay3, OU=noamPlay3
>> Validity
>> Not Before: Jan 27 16:15:17 2016 GMT
>> Not After : Jan 26 16:15:17 2026 GMT
>> Subject: CN=54.194.188.148
>> Subject Public Key Info:
>> Public Key Algorithm: rsaEncryption
>> Public-Key: (2048 bit)
>> Modulus:
>> 00:f1:c5:ba:5d:a7:a9:6d:5c:00:06:93:81:4a:11:
>> 92:b9:4f:80:31:8f:47:75:87:d7:05:dd:33:a8:c6:
>> f6:c8:4c:6d:32:ce:bd:25:25:43:4c:d1:10:4c:50:
>> ee:6b:b5:d4:1f:0f:aa:82:ea:b4:11:d3:98:66:c1:
>> 91:36:ff:7e:db:71:20:24:0c:cb:63:51:e0:eb:8f:
>> 80:43:62:1a:c6:6e:83:f8:20:d7:7a:47:51:de:87:
>> e2:5f:0c:4c:0e:ae:ec:97:1d:c6:ed:12:d2:4c:73:
>> 37:cf:ea:db:ea:f3:74:41:8e:a9:97:c8:79:a4:92:
>> d9:56:35:43:a5:b4:1d:fb:bc:16:ee:07:ce:99:6f:
>> 6a:93:13:10:da:18:4f:bc:30:da:90:15:16:99:d4:
>> ba:44:92:49:6e:d6:6b:9a:c3:4e:d3:0a:bb:d7:31:
>> aa:59:1a:8b:bd:8a:59:e9:0b:8d:2e:51:02:44:20:
>> 77:32:06:cf:c9:70:4c:9a:6b:ba:42:3f:da:3d:28:
>> 61:52:98:34:34:01:c9:77:00:fa:90:b0:ac:d6:ff:
>> 01:4e:05:4e:9f:4b:a4:71:a4:2d:bc:f6:67:fa:cf:
>> 1e:30:2d:85:12:3f:1d:4c:ba:73:81:86:94:92:32:
>> 56:29:a7:2e:4d:0b:87:1b:a6:4e:52:ce:9b:f3:d2:
>> 87:d5
>> Exponent: 65537 (0x10001)
>> X509v3 extensions:
>> X509v3 Basic Constraints:
>> CA:FALSE
>> Netscape Cert Type:
>> SSL Server
>> Netscape Comment:
>> Easy-RSA Generated Server Certificate
>> X509v3 Subject Key Identifier:
>>
>> B1:60:43:05:B6:73:62:73:B4:53:3A:7B:08:AB:C1:6F:D3:22:3E:1D
>> X509v3 Authority Key Identifier:
>>
>> keyid:BB:BC:B5:D7:19:19:E3:78:67:EE:E4:DF:FE:E8:97:EB:29:31:60:07
>> DirName:/CN=noamPlay3/OU=noamPlay3
>> serial:F0:90:EB:0D:FC:14:A2:BB
>>
>> X509v3 Extended Key Usage:
>> TLS Web Server Authentication, 1.3.6.1.5.5.8.2.2
>> X509v3 Key Usage:
>> Digital Signature, Key Encipherment
>> Signature Algorithm: sha256WithRSAEncryption
>> 6a:4a:bf:51:ab:1e:70:c1:c1:2b:82:ad:61:f8:a4:e1:9a:45:
>> c4:d0:5a:d1:f0:97:4c:f1:48:33:a7:2d:d1:fa:01:d4:f2:6f:
>> 34:df:dc:ad:36:7b:2a:01:9d:5f:63:c8:04:9b:e9:80:da:e4:
>> ed:3e:b2:34:e9:15:b9:97:dc:4b:52:9c:c4:1e:12:a5:4c:28:
>> 7f:80:d0:f8:a6:7d:6f:bd:26:0f:c6:fe:50:a6:87:5f:80:9f:
>> 95:85:90:b6:77:9e:c5:38:7e:f2:ba:1a:ff:2a:42:f6:26:c1:
>> 98:31:e1:c8:23:ed:4f:ce:35:89:a7:f3:58:df:f4:97:2b:54:
>> a0:89:a0:f3:8c:77:a5:79:99:19:43:f8:b9:1d:cf:63:f7:5f:
>> 0c:98:18:76:a7:11:6c:e2:71:b9:94:bf:95:d9:7f:d9:2c:09:
>> 38:0f:74:d2:78:02:25:61:d6:a0:2f:b5:14:d6:a9:98:cc:3d:
>> 32:7a:34:0c:28:8d:da:ca:b0:c9:3c:e2:be:4b:44:9e:b0:70:
>> 2a:f2:4e:9f:9b:6a:7a:86:10:85:ab:33:2b:c7:10:3c:ee:9d:
>> a2:85:25:b1:1c:78:dd:fe:b4:37:ed:b8:c4:33:57:a7:72:1d:
>> 42:c3:9c:b7:ba:db:cf:c6:e1:12:e7:7e:8d:ff:55:c5:bc:6c:
>> a4:29:4f:5e
>>
>> The CA certificate:
>> -------------------
>> openssl x509 -text -noout -in /etc/xxx/globalCA.pem
>> Certificate:
>> Data:
>> Version: 3 (0x2)
>> Serial Number: 17334613411045352123 (0xf090eb0dfc14a2bb)
>> Signature Algorithm: sha1WithRSAEncryption
>> Issuer: CN=noamPlay3, OU=noamPlay3
>> Validity
>> Not Before: Jul 9 13:58:30 2014 GMT
>> Not After : Jul 8 13:58:30 2024 GMT
>> Subject: CN=noamPlay3, OU=noamPlay3
>> Subject Public Key Info:
>> Public Key Algorithm: rsaEncryption
>> Public-Key: (2048 bit)
>> Modulus:
>> 00:c9:43:4b:cf:ba:8a:3c:61:e7:8a:0b:e7:08:10:
>> 06:3e:62:6d:ee:7f:a3:65:62:ad:cd:e2:c3:47:48:
>> b5:2d:98:5f:7e:78:da:83:d6:cd:6b:e1:4e:f5:00:
>> 95:5d:5d:73:40:dd:5f:f1:4d:25:ff:1c:58:0b:d3:
>> 12:65:f1:81:00:d8:0d:6e:43:25:fc:44:be:b2:ea:
>> 0b:03:ff:61:d0:64:23:ae:5b:51:b5:09:46:cf:40:
>> 7e:06:c9:8e:52:5b:bc:45:22:25:f8:7a:9b:10:a8:
>> 88:9f:d4:3f:1e:9d:50:0d:06:f7:5e:9f:66:dc:ca:
>> 75:e2:57:2d:1a:2a:18:16:bc:df:8e:1e:85:7c:cb:
>> c1:3f:1c:41:2e:15:42:74:1b:c0:b8:59:c1:55:94:
>> 1c:7b:54:57:4e:de:87:3e:ae:eb:a8:20:a4:c5:ed:
>> d2:4f:fe:82:1a:cf:f3:04:f6:d0:11:06:91:32:14:
>> e1:87:79:cf:e5:da:fd:ba:5f:12:14:d6:db:c7:0a:
>> d9:f3:16:e4:8f:16:aa:b8:f8:c6:d7:dd:03:08:b3:
>> 19:fc:1d:11:de:b9:fe:21:bd:7a:40:95:d5:20:88:
>> 30:9a:34:88:b4:19:1c:26:5a:10:05:af:65:95:7a:
>> ce:3e:ee:0d:68:9f:03:03:53:86:7f:0f:d5:30:c8:
>> 7b:d9
>> Exponent: 65537 (0x10001)
>> X509v3 extensions:
>> X509v3 Subject Key Identifier:
>>
>> BB:BC:B5:D7:19:19:E3:78:67:EE:E4:DF:FE:E8:97:EB:29:31:60:07
>> X509v3 Authority Key Identifier:
>>
>> keyid:BB:BC:B5:D7:19:19:E3:78:67:EE:E4:DF:FE:E8:97:EB:29:31:60:07
>>
>> X509v3 Basic Constraints:
>> CA:TRUE
>> Signature Algorithm: sha1WithRSAEncryption
>> 21:a4:f4:dc:99:d2:5f:48:cb:4c:af:99:e9:72:fe:c9:17:55:
>> 38:d0:ff:f0:a1:d1:8f:d2:8a:17:55:1e:b6:12:1f:9e:9d:34:
>> d7:c8:3b:5d:d4:7e:8a:9b:5d:c8:ef:c4:1b:70:c4:2d:61:97:
>> 5f:42:5b:e3:11:d9:fe:bc:e8:4d:33:cf:ba:fc:7d:b9:2a:33:
>> da:ca:7b:34:a3:44:77:c8:1f:27:f3:bc:2d:68:8c:f8:41:b2:
>> 42:fd:04:38:96:32:b0:b2:16:00:cc:b0:6d:76:77:38:ff:c7:
>> 0d:39:ec:12:9f:d2:cd:35:0a:22:da:a3:db:01:37:67:e4:92:
>> 9b:39:db:8d:c3:e2:28:47:f9:1b:62:20:41:49:cf:60:2d:09:
>> f7:b8:e0:68:16:ba:be:b9:ed:4b:f5:3f:7d:97:5a:7a:6f:38:
>> f1:62:91:f8:19:37:e2:fa:8a:96:71:be:93:49:92:e8:20:9c:
>> dd:e5:25:00:67:2e:77:2a:29:66:40:42:63:fd:5d:17:29:21:
>> 1b:4a:c2:c6:71:8e:6d:7f:ee:a7:24:ac:97:96:54:a1:7f:a9:
>> 35:7b:be:f8:41:3b:82:62:29:4d:86:7e:8f:66:1e:51:fe:cf:
>> a6:39:d8:ed:61:e1:cb:a2:8e:61:7b:c0:c8:a8:92:ae:03:ac:
>> de:93:bf:fb
>> I believe the related logs for the failure are the following:
>> -------------------------------------------------------------
>>
>> One side:
>>
>> Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | handling event
>> EVENT_v1_RETRANSMIT for state #2
>> Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | processing
>> connection "connST603/1x1"
>> Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | handling event
>> EVENT_v1_RETRANSMIT for 54.194.210.197 "connST603/1x1" #2 attempt
>> 0 of 0
>> Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: "connST603/1x1" #2:
>> max number of retransmissions (8) reached STATE_MAIN_R2
>> Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: "connST603/1x1" #2:
>> deleting state #2 (STATE_MAIN_R2)
>> Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | parent state #2:
>> STATE_MAIN_R2(open-ike) > delete
>> Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | state: #2
>> requesting to delete non existing event
>> Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | unhashing state
>> object #2
>> Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | removing state
>> 0x7f9ccfda9e70 entry 0x7f9ccfdaa4d8 next (nil) prev-next
>> 0x7f9cce0e5338 from list
>> Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | updated next entry
>> is (nil)
>> Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | removing state
>> 0x7f9ccfda9e70 entry 0x7f9ccfdaa4f0 next (nil) prev-next
>> 0x7f9cce0e54b8 from list
>> Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | updated next entry
>> is (nil)
>> Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | parent state #2:
>> STATE_MAIN_R2(open-ike) > STATE_UNDEFINED(ignore)
>> Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | ignore states: 0
>> Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | half-open-ike
>> states: 0
>> Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | open-ike states: 0
>> Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: |
>> established-anonymous-ike states: 0
>> Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: |
>> established-authenticated-ike states: 0
>> Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | anonymous-ipsec
>> states: 0
>> Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: |
>> authenticated-ipsec states: 0
>> Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | informational
>> states: 0
>> Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | unknown states: 0
>> Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | category states: 0
>> count states: 0
>> Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: |
>> st->st_skeyseed_nss: free key 0x7f9ccfda2720
>> Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | st->st_skey_d_nss:
>> free key 0x7f9cc00115f0
>> Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: |
>> st->st_skey_ai_nss: free key 0x7f9cc0015ab0
>> Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: |
>> st->st_skey_ar_nss: free key NULL
>> Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: |
>> st->st_skey_ei_nss: free key 0x7f9cc0017330
>> Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: |
>> st->st_skey_er_nss: free key NULL
>> Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: |
>> st->st_skey_pi_nss: free key NULL
>> Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: |
>> st->st_skey_pr_nss: free key NULL
>> Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: |
>> st->st_enc_key_nss: free key 0x7f9cc0018bb0
>> Other side:
>>
>> Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | handling event
>> EVENT_v1_RETRANSMIT for state #1
>> Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | processing
>> connection "connST603/1x1"
>> Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | handling event
>> EVENT_v1_RETRANSMIT for 54.194.188.148 "connST603/1x1" #1 attempt
>> 1 of 0
>> Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: "connST603/1x1" #1:
>> max number of retransmissions (8) reached STATE_MAIN_I3. Possible
>> authentication failure: no acceptable response to our first
>> encrypted message
>> Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: "connST603/1x1" #1:
>> deleting state #1 (STATE_MAIN_I3)
>> Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | parent state #1:
>> STATE_MAIN_I3(open-ike) > delete
>> Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | state: #1
>> requesting to delete non existing event
>> Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | removing pending
>> policy for "connST603/1x1" {0x7fdf350ed320}
>> Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | unhashing state
>> object #1
>> Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | removing state
>> 0x7fdf350e9f50 entry 0x7fdf350ea5b8 next (nil) prev-next
>> 0x7fdf340f2338 from list
>> Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | updated next entry
>> is (nil)
>> Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | removing state
>> 0x7fdf350e9f50 entry 0x7fdf350ea5d0 next (nil) prev-next
>> 0x7fdf340f24b8 from list
>> Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | updated next entry
>> is (nil)
>> Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | parent state #1:
>> STATE_MAIN_I3(open-ike) > STATE_UNDEFINED(ignore)
>> Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | ignore states: 0
>> Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | half-open-ike states: 0
>> Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | open-ike states: 0
>> Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: |
>> established-anonymous-ike states: 0
>> Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: |
>> established-authenticated-ike states: 0
>> Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | anonymous-ipsec
>> states: 0
>> Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | authenticated-ipsec
>> states: 0
>> Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | informational states: 0
>> Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | unknown states: 0
>> Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | category states: 0
>> count states: 0
>> Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: |
>> st->st_skeyseed_nss: free key 0x7fdf24006910
>> Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | st->st_skey_d_nss:
>> free key 0x7fdf240098e0
>> Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | st->st_skey_ai_nss:
>> free key 0x7fdf2400b160
>> Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | st->st_skey_ar_nss:
>> free key NULL
>> Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | st->st_skey_ei_nss:
>> free key 0x7fdf2400c9e0
>> Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | st->st_skey_er_nss:
>> free key NULL
>> Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | st->st_skey_pi_nss:
>> free key NULL
>> Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | st->st_skey_pr_nss:
>> free key NULL
>> Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | st->st_enc_key_nss:
>> free key 0x7fdf2400e260
>>
>>
>>
>> _______________________________________________
>> Swan mailing list
>> Swan at lists.libreswan.org <mailto:Swan at lists.libreswan.org>
>> https://lists.libreswan.org/mailman/listinfo/swan
>
>
>
>
> _______________________________________________
> Swan mailing list
> Swan at lists.libreswan.org
> https://lists.libreswan.org/mailman/listinfo/swan
>
More information about the Swan
mailing list