<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head><body lang="EN-GB" link="#0563C1" vlink="#954F72">
<br />
<br />
<div class="WordSection1">
<p class="MsoNormal">Hi<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’m after a little help, not certain I’m fully on the right track.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I have successfully secured traffic between LibreSwan and multiple dynamic Windows hosts using preshared key and transport mode, as below as an example.
<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">conn secure_hosts<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">type=transport<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">authby=secret<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">left=192.168.10.130<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">right=%any<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">pfs=yes<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">ike=3des-sha1;modp1024<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">phase2=esp<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">auto=ondemand<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">conn block-plain1<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">left=192.168.10.130<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">right=%any<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">rightsubnet=192.168.10.132/30<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">type=drop<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">authby=never<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">auto=ondemand<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt"># low priority so secure_host wins when up<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">priority=6000<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Now that I have this working I would like to change it over to using certificates if possible. I’ve created and imported a certificate with chain into libreSwan and imported the certificate authority into my windows VM I’m using for testing.
So far I’ve tried;<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">Modifying the above and adding various combinations of the below from what sources of help I’ve been able to find online.<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:72.0pt">authby=rsasig<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:72.0pt">leftrsasigkey=%cert<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:72.0pt">leftcert=example.mydomain.net<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:72.0pt">leftsendcert=always<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:72.0pt">leftid=@example.mydomain.net<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:72.0pt">right=%any<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:72.0pt">rightca=%same<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:72.0pt">rightrsasigkey=%cert<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">On the windows client I’ve replaced preshared key authentication method and selected ‘Use a certificate from this certification authority (CA)’.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Any advice is welcome. <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Matt<b><span style="mso-fareast-language:EN-GB"><o:p></o:p></span></b></p>
</div>
<br />
<span style="font-family:Calibri; Font-size:9.0pt">
***************************<br />
<i>Information contained in this e-mail is intended for the use of the addressee only, is confidential and may be the subject of Legal Professional Privilege. Any dissemination, distribution, copying or use of this communication without our prior permission or that of the addressee is strictly prohibited.<br />
The contents of an attachment to this e-mail may contain software viruses, which could damage your own computer system. While Tribal has taken every reasonable precaution to minimise this risk, we cannot accept liability for any damage which you sustain as a result of software viruses. You should carry out your own virus checks before opening the attachment.
<br />
</i></span></body></html>