<div dir="ltr"><div class="gmail_default"><font face="arial, helvetica, sans-serif">Thank you all for all your help</font></div><div class="gmail_default"><font face="arial, helvetica, sans-serif"></font></div><div class="gmail_default"><font face="arial, helvetica, sans-serif">My hunch is that the failure relates to </font><span style="font-size:12.8px">subjectAltName</span></div><div class="gmail_default"><span style="font-size:12.8px">I'll be taking all comments into account and update you as soon as I have something working</span></div><div class="gmail_extra"><font face="arial, helvetica, sans-serif"><br></font></div><div class="gmail_extra"><font face="arial, helvetica, sans-serif"><div class="gmail_default" style="font-family:monospace,monospace;display:inline">Thank you all</div><br clear="all"></font><div><div class="gmail_signature"><div dir="ltr"><div dir="ltr"><font face="arial, helvetica, sans-serif"><br></font><div><font face="arial, helvetica, sans-serif">Noam Singer<br></font></div><div><font face="arial, helvetica, sans-serif"> <br></font></div><span><font color="#888888" face="arial, helvetica, sans-serif"></font></span></div></div></div></div>
<font face="arial, helvetica, sans-serif"><br></font><div class="gmail_quote"><font face="arial, helvetica, sans-serif">On Tue, Feb 2, 2016 at 9:07 AM, Tuomo Soini <span dir="ltr"><<a href="mailto:tis@foobar.fi" target="_blank">tis@foobar.fi</a>></span> wrote:<br></font><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><font face="arial, helvetica, sans-serif"><span class="">On Mon, 1 Feb 2016 15:02:41 +0200<br>
Noam Singer <<a href="mailto:noam@fortycloud.com">noam@fortycloud.com</a>> wrote:<br>
<br>
> Hello<br>
><br>
> I am trying to set an IPSec connection with certificates (same CA for<br>
> both certs), but my connection does not pass the STATE_MAIN_I3 state.<br>
><br>
> Is there a way to better troubleshoot the PKI failures<br>
> Am I doing something wrong?<br>
><br>
> I would appreciate any help.<br>
><br>
> Thanks in advance<br>
><br>
><br>
><br>
> I have setup the following configuration<br>
><br>
> Using LibreSwan 3.15<br>
<br>
</span>Libreswan - No capital letters in word.<br>
<span class="">><br>
> /etc/ipsec.secrets:<br>
> -------------------<br>
> 54.194.188.148 54.194.210.197 : RSA globalCertificate<br>
<br>
</span>This line is not needed or used with certificates, remove it to get rid<br>
of warning about unused config option.<br>
<span class="">><br>
> /etc/ipsec.conf:<br>
> ----------------<br>
> config setup<br>
> plutodebug = all<br>
<br>
</span>plutodebug=none is only sensible option. Do this first to get readable<br>
and understandable logs. Those are debug options, enable those only if<br>
somebody here requests you to enable debugging options.<br>
<br>
Also note: "plutodebug = all" is not correct line. Spaces are not<br>
allowed on random places in config file.<br>
<br>
> include /etc/ipsec.d/*.conf<br>
><br>
><br>
> /etc/ipsec.d/connST603.conf:<br>
> ----------------------------<br>
<br>
Config format issue here too. No " = ".<br>
<span class=""><br>
> conn connST603<br>
> authby = rsasig<br>
> auto = start<br>
> dpdaction = restart<br>
> dpddelay = 30<br>
> dpdtimeout = 120<br>
> esp = aes128-sha1<br>
<br>
</span>With libreswan, option name is phase2alg=<br>
<br>
phase2alg=aes128-sha1<br>
<br>
> forceencaps = yes<br>
<br>
You don't want forceencaps=yes without very very good reason like<br>
broken firewall rule blocking ESP (IP proto 50) traffic.<br>
<br>
> ike = aes128-sha1<br>
<br>
Same about diffie-hellman group belongs to here.<br>
<span class=""><br>
> ikelifetime = 86400s<br>
> left = %defaultroute<br>
> leftcert = globalCertificate<br>
> leftid = 54.194.188.148<br>
> leftrsasigkey = %cert<br>
> leftsubnets = <a href="http://172.24.128.0/24" rel="noreferrer" target="_blank">172.24.128.0/24</a><br>
<br>
</span>Here is one subnet only. Do not use leftsubnets, use leftsubnet=<br>
<br>
> lifetime = 28800s<br>
<br>
Unrecognized option, lifetime. We have ikelifetime= for phase1<br>
<span class=""><br>
> pfs = no<br>
> right = 54.194.210.197<br>
> rightid = 54.194.210.197<br>
<br>
</span>This rightid only works if remote ceriticate has IP type subjectAtlName<br>
in their certificate. I'm quite sure they don't hae anything like that<br>
there. Usually rightid=%fromcert works if remote end offers certificate<br>
subject as ID. So use rightid=%fromcert and leftid=%fromcert. And if<br>
certificates are from same ca, I'd use rightca=%same for added security.<br>
<br>
> rightsubnets = <a href="http://172.24.131.0/24" rel="noreferrer" target="_blank">172.24.131.0/24</a><br>
<br>
Again, rightsubnet= because you only have one subnet listed.<br>
<br>
Below I can see from your cert there is no subjectAltName= specified so<br>
your only possible ID type is ID_DER_ASN1_DN also known as ceritificate<br>
subject.<br>
<span class="im"><br>
> type = tunnel<br>
><br>
> ** I also tried using leftid="CN=...", but got similar results<br>
> The certificates look fine to me<br>
><br>
> The signed certificate:<br>
> -----------------------<br>
<br>
</span><span class=""><font color="#888888">--<br>
Tuomo Soini <<a href="mailto:tis@foobar.fi">tis@foobar.fi</a>><br>
Foobar Linux services<br>
<a href="tel:%2B358%2040%205240030" value="+358405240030">+358 40 5240030</a><br>
Foobar Oy <<a href="http://foobar.fi/" rel="noreferrer" target="_blank">http://foobar.fi/</a>><br>
</font></span></font><div class=""><div class="h5"><font face="arial, helvetica, sans-serif">_______________________________________________<br>
Swan mailing list<br>
<a href="mailto:Swan@lists.libreswan.org">Swan@lists.libreswan.org</a><br>
<a href="https://lists.libreswan.org/mailman/listinfo/swan" rel="noreferrer" target="_blank">https://lists.libreswan.org/mailman/listinfo/swan</a><br>
</font></div></div></blockquote></div><br></div></div>