​Using leftid=%fromcert did not help. I tried digging into the logs but I can't find the root cause. How can I troubleshoot PKI based authentication?
Thanks​ Noam Singer *Co-founder and * *CSO * *FortyCloud Ltd.* Cell: +972 54 242 1064 Fax: +972 72 215 2980 Email: [email protected] Web: www.fortycloud.com Skype: noamsinger *FortyCloud - Make your Public Cloud Private* On Mon, Feb 1, 2016 at 3:20 PM, Paul Wouters <[email protected]> wrote: > Try using leftid=%fromcert > > The logs only showed the retransmits, not the original failure > > Paul > > Sent from my iPhone > > On Feb 1, 2016, at 14:02, Noam Singer <[email protected]> wrote: > > Hello > > I am trying to set an IPSec connection with certificates (same CA for both > certs), but my connection does not pass the STATE_MAIN_I3 state. > > Is there a way to better troubleshoot the PKI failures > Am I doing something wrong? > > I would appreciate any help. > > Thanks in advance > > > > I have setup the following configuration > > Using LibreSwan 3.15 > > /etc/ipsec.secrets: > ------------------- > 54.194.188.148 54.194.210.197 : RSA globalCertificate > > > /etc/ipsec.conf: > ---------------- > config setup > plutodebug = all > include /etc/ipsec.d/*.conf > > > /etc/ipsec.d/connST603.conf: > ---------------------------- > conn connST603 > authby = rsasig > auto = start > dpdaction = restart > dpddelay = 30 > dpdtimeout = 120 > esp = aes128-sha1 > forceencaps = yes > ike = aes128-sha1 > ikelifetime = 86400s > left = %defaultroute > leftcert = globalCertificate > leftid = 54.194.188.148 > leftrsasigkey = %cert > leftsubnets = 172.24.128.0/24 > lifetime = 28800s > pfs = no > right = 54.194.210.197 > rightid = 54.194.210.197 > rightsubnets = 172.24.131.0/24 > type = tunnel > > ** I also tried using leftid="CN=...", but got similar results > The certificates look fine to me > > The signed certificate: > ----------------------- > openssl x509 -text -noout -in /etc/xxx/globalCertificate.pem > Certificate: > Data: > Version: 3 (0x2) > Serial Number: 1 (0x1) > Signature Algorithm: sha256WithRSAEncryption > Issuer: CN=noamPlay3, OU=noamPlay3 > Validity > Not Before: Jan 27 16:15:17 2016 GMT > Not After : Jan 26 16:15:17 2026 GMT > Subject: CN=54.194.188.148 > Subject Public Key Info: > Public Key Algorithm: rsaEncryption > Public-Key: (2048 bit) > Modulus: > 00:f1:c5:ba:5d:a7:a9:6d:5c:00:06:93:81:4a:11: > 92:b9:4f:80:31:8f:47:75:87:d7:05:dd:33:a8:c6: > f6:c8:4c:6d:32:ce:bd:25:25:43:4c:d1:10:4c:50: > ee:6b:b5:d4:1f:0f:aa:82:ea:b4:11:d3:98:66:c1: > 91:36:ff:7e:db:71:20:24:0c:cb:63:51:e0:eb:8f: > 80:43:62:1a:c6:6e:83:f8:20:d7:7a:47:51:de:87: > e2:5f:0c:4c:0e:ae:ec:97:1d:c6:ed:12:d2:4c:73: > 37:cf:ea:db:ea:f3:74:41:8e:a9:97:c8:79:a4:92: > d9:56:35:43:a5:b4:1d:fb:bc:16:ee:07:ce:99:6f: > 6a:93:13:10:da:18:4f:bc:30:da:90:15:16:99:d4: > ba:44:92:49:6e:d6:6b:9a:c3:4e:d3:0a:bb:d7:31: > aa:59:1a:8b:bd:8a:59:e9:0b:8d:2e:51:02:44:20: > 77:32:06:cf:c9:70:4c:9a:6b:ba:42:3f:da:3d:28: > 61:52:98:34:34:01:c9:77:00:fa:90:b0:ac:d6:ff: > 01:4e:05:4e:9f:4b:a4:71:a4:2d:bc:f6:67:fa:cf: > 1e:30:2d:85:12:3f:1d:4c:ba:73:81:86:94:92:32: > 56:29:a7:2e:4d:0b:87:1b:a6:4e:52:ce:9b:f3:d2: > 87:d5 > Exponent: 65537 (0x10001) > X509v3 extensions: > X509v3 Basic Constraints: > CA:FALSE > Netscape Cert Type: > SSL Server > Netscape Comment: > Easy-RSA Generated Server Certificate > X509v3 Subject Key Identifier: > B1:60:43:05:B6:73:62:73:B4:53:3A:7B:08:AB:C1:6F:D3:22:3E:1D > X509v3 Authority Key Identifier: > > keyid:BB:BC:B5:D7:19:19:E3:78:67:EE:E4:DF:FE:E8:97:EB:29:31:60:07 > DirName:/CN=noamPlay3/OU=noamPlay3 > serial:F0:90:EB:0D:FC:14:A2:BB > > X509v3 Extended Key Usage: > TLS Web Server Authentication, 1.3.6.1.5.5.8.2.2 > X509v3 Key Usage: > Digital Signature, Key Encipherment > Signature Algorithm: sha256WithRSAEncryption > 6a:4a:bf:51:ab:1e:70:c1:c1:2b:82:ad:61:f8:a4:e1:9a:45: > c4:d0:5a:d1:f0:97:4c:f1:48:33:a7:2d:d1:fa:01:d4:f2:6f: > 34:df:dc:ad:36:7b:2a:01:9d:5f:63:c8:04:9b:e9:80:da:e4: > ed:3e:b2:34:e9:15:b9:97:dc:4b:52:9c:c4:1e:12:a5:4c:28: > 7f:80:d0:f8:a6:7d:6f:bd:26:0f:c6:fe:50:a6:87:5f:80:9f: > 95:85:90:b6:77:9e:c5:38:7e:f2:ba:1a:ff:2a:42:f6:26:c1: > 98:31:e1:c8:23:ed:4f:ce:35:89:a7:f3:58:df:f4:97:2b:54: > a0:89:a0:f3:8c:77:a5:79:99:19:43:f8:b9:1d:cf:63:f7:5f: > 0c:98:18:76:a7:11:6c:e2:71:b9:94:bf:95:d9:7f:d9:2c:09: > 38:0f:74:d2:78:02:25:61:d6:a0:2f:b5:14:d6:a9:98:cc:3d: > 32:7a:34:0c:28:8d:da:ca:b0:c9:3c:e2:be:4b:44:9e:b0:70: > 2a:f2:4e:9f:9b:6a:7a:86:10:85:ab:33:2b:c7:10:3c:ee:9d: > a2:85:25:b1:1c:78:dd:fe:b4:37:ed:b8:c4:33:57:a7:72:1d: > 42:c3:9c:b7:ba:db:cf:c6:e1:12:e7:7e:8d:ff:55:c5:bc:6c: > a4:29:4f:5e > > > The CA certificate: > ------------------- > openssl x509 -text -noout -in /etc/xxx/globalCA.pem > Certificate: > Data: > Version: 3 (0x2) > Serial Number: 17334613411045352123 (0xf090eb0dfc14a2bb) > Signature Algorithm: sha1WithRSAEncryption > Issuer: CN=noamPlay3, OU=noamPlay3 > Validity > Not Before: Jul 9 13:58:30 2014 GMT > Not After : Jul 8 13:58:30 2024 GMT > Subject: CN=noamPlay3, OU=noamPlay3 > Subject Public Key Info: > Public Key Algorithm: rsaEncryption > Public-Key: (2048 bit) > Modulus: > 00:c9:43:4b:cf:ba:8a:3c:61:e7:8a:0b:e7:08:10: > 06:3e:62:6d:ee:7f:a3:65:62:ad:cd:e2:c3:47:48: > b5:2d:98:5f:7e:78:da:83:d6:cd:6b:e1:4e:f5:00: > 95:5d:5d:73:40:dd:5f:f1:4d:25:ff:1c:58:0b:d3: > 12:65:f1:81:00:d8:0d:6e:43:25:fc:44:be:b2:ea: > 0b:03:ff:61:d0:64:23:ae:5b:51:b5:09:46:cf:40: > 7e:06:c9:8e:52:5b:bc:45:22:25:f8:7a:9b:10:a8: > 88:9f:d4:3f:1e:9d:50:0d:06:f7:5e:9f:66:dc:ca: > 75:e2:57:2d:1a:2a:18:16:bc:df:8e:1e:85:7c:cb: > c1:3f:1c:41:2e:15:42:74:1b:c0:b8:59:c1:55:94: > 1c:7b:54:57:4e:de:87:3e:ae:eb:a8:20:a4:c5:ed: > d2:4f:fe:82:1a:cf:f3:04:f6:d0:11:06:91:32:14: > e1:87:79:cf:e5:da:fd:ba:5f:12:14:d6:db:c7:0a: > d9:f3:16:e4:8f:16:aa:b8:f8:c6:d7:dd:03:08:b3: > 19:fc:1d:11:de:b9:fe:21:bd:7a:40:95:d5:20:88: > 30:9a:34:88:b4:19:1c:26:5a:10:05:af:65:95:7a: > ce:3e:ee:0d:68:9f:03:03:53:86:7f:0f:d5:30:c8: > 7b:d9 > Exponent: 65537 (0x10001) > X509v3 extensions: > X509v3 Subject Key Identifier: > BB:BC:B5:D7:19:19:E3:78:67:EE:E4:DF:FE:E8:97:EB:29:31:60:07 > X509v3 Authority Key Identifier: > > keyid:BB:BC:B5:D7:19:19:E3:78:67:EE:E4:DF:FE:E8:97:EB:29:31:60:07 > > X509v3 Basic Constraints: > CA:TRUE > Signature Algorithm: sha1WithRSAEncryption > 21:a4:f4:dc:99:d2:5f:48:cb:4c:af:99:e9:72:fe:c9:17:55: > 38:d0:ff:f0:a1:d1:8f:d2:8a:17:55:1e:b6:12:1f:9e:9d:34: > d7:c8:3b:5d:d4:7e:8a:9b:5d:c8:ef:c4:1b:70:c4:2d:61:97: > 5f:42:5b:e3:11:d9:fe:bc:e8:4d:33:cf:ba:fc:7d:b9:2a:33: > da:ca:7b:34:a3:44:77:c8:1f:27:f3:bc:2d:68:8c:f8:41:b2: > 42:fd:04:38:96:32:b0:b2:16:00:cc:b0:6d:76:77:38:ff:c7: > 0d:39:ec:12:9f:d2:cd:35:0a:22:da:a3:db:01:37:67:e4:92: > 9b:39:db:8d:c3:e2:28:47:f9:1b:62:20:41:49:cf:60:2d:09: > f7:b8:e0:68:16:ba:be:b9:ed:4b:f5:3f:7d:97:5a:7a:6f:38: > f1:62:91:f8:19:37:e2:fa:8a:96:71:be:93:49:92:e8:20:9c: > dd:e5:25:00:67:2e:77:2a:29:66:40:42:63:fd:5d:17:29:21: > 1b:4a:c2:c6:71:8e:6d:7f:ee:a7:24:ac:97:96:54:a1:7f:a9: > 35:7b:be:f8:41:3b:82:62:29:4d:86:7e:8f:66:1e:51:fe:cf: > a6:39:d8:ed:61:e1:cb:a2:8e:61:7b:c0:c8:a8:92:ae:03:ac: > de:93:bf:fb > > > > I believe the related logs for the failure are the following: > ------------------------------------------------------------- > > One side: > > Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | handling event > EVENT_v1_RETRANSMIT for state #2 > Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | processing connection > "connST603/1x1" > Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | handling event > EVENT_v1_RETRANSMIT for 54.194.210.197 "connST603/1x1" #2 attempt 0 of 0 > Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: "connST603/1x1" #2: max > number of retransmissions (8) reached STATE_MAIN_R2 > Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: "connST603/1x1" #2: deleting > state #2 (STATE_MAIN_R2) > Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | parent state #2: > STATE_MAIN_R2(open-ike) > delete > Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | state: #2 requesting to > delete non existing event > Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | unhashing state object #2 > Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | removing state > 0x7f9ccfda9e70 entry 0x7f9ccfdaa4d8 next (nil) prev-next 0x7f9cce0e5338 > from list > Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | updated next entry is (nil) > Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | removing state > 0x7f9ccfda9e70 entry 0x7f9ccfdaa4f0 next (nil) prev-next 0x7f9cce0e54b8 > from list > Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | updated next entry is (nil) > Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | parent state #2: > STATE_MAIN_R2(open-ike) > STATE_UNDEFINED(ignore) > Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | ignore states: 0 > Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | half-open-ike states: 0 > Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | open-ike states: 0 > Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | established-anonymous-ike > states: 0 > Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | > established-authenticated-ike states: 0 > Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | anonymous-ipsec states: 0 > Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | authenticated-ipsec > states: 0 > Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | informational states: 0 > Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | unknown states: 0 > Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | category states: 0 count > states: 0 > Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | st->st_skeyseed_nss: free > key 0x7f9ccfda2720 > Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | st->st_skey_d_nss: free > key 0x7f9cc00115f0 > Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | st->st_skey_ai_nss: free > key 0x7f9cc0015ab0 > Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | st->st_skey_ar_nss: free > key NULL > Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | st->st_skey_ei_nss: free > key 0x7f9cc0017330 > Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | st->st_skey_er_nss: free > key NULL > Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | st->st_skey_pi_nss: free > key NULL > Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | st->st_skey_pr_nss: free > key NULL > Feb 1 12:53:01 ip-10-10-10-195 pluto[16502]: | st->st_enc_key_nss: free > key 0x7f9cc0018bb0 > > Other side: > > Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | handling event > EVENT_v1_RETRANSMIT for state #1 > Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | processing connection > "connST603/1x1" > Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | handling event > EVENT_v1_RETRANSMIT for 54.194.188.148 "connST603/1x1" #1 attempt 1 of 0 > Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: "connST603/1x1" #1: max > number of retransmissions (8) reached STATE_MAIN_I3. Possible > authentication failure: no acceptable response to our first encrypted > message > Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: "connST603/1x1" #1: deleting > state #1 (STATE_MAIN_I3) > Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | parent state #1: > STATE_MAIN_I3(open-ike) > delete > Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | state: #1 requesting to > delete non existing event > Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | removing pending policy for > "connST603/1x1" {0x7fdf350ed320} > Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | unhashing state object #1 > Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | removing state > 0x7fdf350e9f50 entry 0x7fdf350ea5b8 next (nil) prev-next 0x7fdf340f2338 > from list > Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | updated next entry is (nil) > Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | removing state > 0x7fdf350e9f50 entry 0x7fdf350ea5d0 next (nil) prev-next 0x7fdf340f24b8 > from list > Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | updated next entry is (nil) > Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | parent state #1: > STATE_MAIN_I3(open-ike) > STATE_UNDEFINED(ignore) > Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | ignore states: 0 > Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | half-open-ike states: 0 > Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | open-ike states: 0 > Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | established-anonymous-ike > states: 0 > Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | > established-authenticated-ike states: 0 > Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | anonymous-ipsec states: 0 > Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | authenticated-ipsec states: > 0 > Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | informational states: 0 > Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | unknown states: 0 > Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | category states: 0 count > states: 0 > Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | st->st_skeyseed_nss: free > key 0x7fdf24006910 > Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | st->st_skey_d_nss: free key > 0x7fdf240098e0 > Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | st->st_skey_ai_nss: free > key 0x7fdf2400b160 > Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | st->st_skey_ar_nss: free > key NULL > Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | st->st_skey_ei_nss: free > key 0x7fdf2400c9e0 > Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | st->st_skey_er_nss: free > key NULL > Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | st->st_skey_pi_nss: free > key NULL > Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | st->st_skey_pr_nss: free > key NULL > Feb 1 12:53:01 ip-10-10-10-78 pluto[28151]: | st->st_enc_key_nss: free > key 0x7fdf2400e260 > > > > > > _______________________________________________ > Swan mailing list > [email protected] > https://lists.libreswan.org/mailman/listinfo/swan > >
_______________________________________________ Swan mailing list [email protected] https://lists.libreswan.org/mailman/listinfo/swan
