ECDSA failures with Strongswan 5.0.2 and openssl 1.0.1e-fips
Apr 2 14:59:33 00[LIB] building CRED_PRIVATE_KEY - ECDSA failed, tried 2 builders Apr 2 14:59:33 00[CFG] loading private key from '/etc/strongswan/ipsec.d/private/outerKey.pem' failed I'm also seeing these messages related to the private key that was generated on the server: Apr 2 15:18:16 00[ASN] L1 - encryptionAlgorithm: Apr 2 15:18:16 00[ASN] L2 - algorithmIdentifier: ASN1 tag 0x30 expected, but is 0x02 I'm not sure where the source of failure is, the build, cert/key cretion, or stongswan configuration. These are the configure parameters used when building Strongswan: ./configure --enable-openssl --prefix=/usr --sysconfdir=/etc make make install Here are the commands used to generate the keys and cert request: # ipsec pki --gen --type ecdsa --size 384 > ecdsaKey.pem # ipsec pki --req --in ecdsaKey.pem --type ecdsa --dn "C=US,ST=Texas,L=City,O=Company,OU=Engineering,CN=10.50.102.44" --digest sha384 –outform pem > ecdsaReq.pem Here are the modules loaded in strongswan.conf load = openssl fips-prf charon aes des sha1 sha2 md5 random nonce x509 pubkey pkcs1 pkcs8 pgp pem gmp xcbc hmac kernel-netlink socket-default stroke updown Below is the full strongswan restart logs: Thanks, Scot Apr 2 15:18:13 00[DMN] signal of type SIGINT received. Shutting down Apr 2 15:18:13 00[MGR] going to destroy IKE_SA manager and all managed IKE_SA's Apr 2 15:18:13 00[MGR] set driveout flags for all stored IKE_SA's Apr 2 15:18:13 00[MGR] wait for all threads to leave IKE_SA's Apr 2 15:18:13 00[MGR] delete all IKE_SA's Apr 2 15:18:13 00[MGR] destroy all entries Apr 2 15:18:13 03[JOB] terminated worker thread 03 Apr 2 15:18:13 06[JOB] terminated worker thread 06 Apr 2 15:18:13 01[JOB] terminated worker thread 01 Apr 2 15:18:13 05[JOB] terminated worker thread 05 Apr 2 15:18:13 02[JOB] terminated worker thread 02 Apr 2 15:18:13 04[JOB] terminated worker thread 04 Apr 2 15:18:13 07[JOB] terminated worker thread 07 tail: /var/log/charon.log: file truncated Apr 2 15:18:16 00[DMN] Starting IKE charon daemon (strongSwan 5.0.0, Linux 2.6.32-358.el6.x86_64, x86_64) Apr 2 15:18:16 00[LIB] plugin 'openssl': loaded successfully Apr 2 15:18:16 00[LIB] plugin 'fips-prf': loaded successfully Apr 2 15:18:16 00[LIB] plugin 'aes': loaded successfully Apr 2 15:18:16 00[LIB] plugin 'des': loaded successfully Apr 2 15:18:16 00[LIB] plugin 'sha1': loaded successfully Apr 2 15:18:16 00[LIB] plugin 'sha2': loaded successfully Apr 2 15:18:16 00[LIB] plugin 'md5': loaded successfully Apr 2 15:18:16 00[LIB] plugin 'random': loaded successfully Apr 2 15:18:16 00[LIB] plugin 'nonce': loaded successfully Apr 2 15:18:16 00[LIB] plugin 'x509': loaded successfully Apr 2 15:18:16 00[LIB] plugin 'pubkey': loaded successfully Apr 2 15:18:16 00[LIB] plugin 'pkcs1': loaded successfully Apr 2 15:18:16 00[LIB] plugin 'pkcs8': loaded successfully Apr 2 15:18:16 00[LIB] plugin 'pgp': loaded successfully Apr 2 15:18:16 00[LIB] plugin 'pem': loaded successfully Apr 2 15:18:16 00[LIB] plugin 'gmp': loaded successfully Apr 2 15:18:16 00[LIB] plugin 'xcbc': loaded successfully Apr 2 15:18:16 00[LIB] plugin 'hmac': loaded successfully Apr 2 15:18:16 00[LIB] plugin 'kernel-netlink': loaded successfully Apr 2 15:18:16 00[KNL] detected Linux 2.6.32, no support for RTA_PREFSRC for IPv6 routes Apr 2 15:18:16 00[KNL] listening on interfaces: Apr 2 15:18:16 00[KNL] eth0 Apr 2 15:18:16 00[KNL] 10.50.102.44 Apr 2 15:18:16 00[KNL] fe80::20c:29ff:fe7b:94b9 Apr 2 15:18:16 00[KNL] eth1 Apr 2 15:18:16 00[KNL] fe80::20c:29ff:fe7b:94c3 Apr 2 15:18:16 00[LIB] plugin 'socket-default': loaded successfully Apr 2 15:18:16 00[LIB] plugin 'stroke': loaded successfully Apr 2 15:18:16 00[LIB] plugin 'updown': loaded successfully Apr 2 15:18:16 00[CFG] loading ca certificates from '/etc/strongswan/ipsec.d/cacerts' Apr 2 15:18:16 00[ASN] file content is not binary ASN.1 Apr 2 15:18:16 00[ASN] -----BEGIN CERTIFICATE----- Apr 2 15:18:16 00[ASN] -----END CERTIFICATE----- Apr 2 15:18:16 00[LIB] OpenSSL X.509 parsing failed Apr 2 15:18:16 00[ASN] L0 - x509: Apr 2 15:18:16 00[ASN] L1 - tbsCertificate: Apr 2 15:18:16 00[ASN] L2 - DEFAULT v1: Apr 2 15:18:16 00[ASN] X.509v1 Apr 2 15:18:16 00[ASN] L2 - serialNumber: Apr 2 15:18:16 00[ASN] L2 - signature: Apr 2 15:18:16 00[ASN] L3 - algorithmIdentifier: Apr 2 15:18:16 00[ASN] L4 - algorithm: Apr 2 15:18:16 00[ASN] 'ecdsa-with-SHA384' Apr 2 15:18:16 00[ASN] L2 - issuer: Apr 2 15:18:16 00[ASN] 'C=US, ST=Texas, L=City, O=Company, OU=Engineering, CN=ca.company.com' Apr 2 15:18:16 00[ASN] L2 - validity: Apr 2 15:18:16 00[ASN] L3 - notBefore: Apr 2 15:18:16 00[ASN] L4 - utcTime: Apr 2 15:18:16 00[ASN] 'Mar 29 12:21:59 UTC 2013' Apr 2 15:18:16 00[ASN] L3 - notAfter: Apr 2 15:18:16 00[ASN] L4 - utcTime: Apr 2 15:18:16 00[ASN] 'Mar 27 12:21:59 UTC 2023' Apr 2 15:18:16 00[ASN] L2 - subject: Apr 2 15:18:16 00[ASN] 'C=US, ST=Texas, L=City, O=Company, OU=Engineering, CN=ca.company.com' Apr 2 15:18:16 00[ASN] L2 - subjectPublicKeyInfo: Apr 2 15:18:16 00[ASN] -- > -- Apr 2 15:18:16 00[ASN] L0 - subjectPublicKeyInfo: Apr 2 15:18:16 00[ASN] L1 - algorithm: Apr 2 15:18:16 00[ASN] L2 - algorithmIdentifier: Apr 2 15:18:16 00[ASN] L3 - algorithm: Apr 2 15:18:16 00[ASN] 'id-ecPublicKey' Apr 2 15:18:16 00[ASN] L3 - parameters: Apr 2 15:18:16 00[ASN] -- < -- Apr 2 15:18:16 00[LIB] building CRED_CERTIFICATE - X509 failed, tried 4 builders Apr 2 15:18:16 00[CFG] loading ca certificate from '/etc/strongswan/ipsec.d/cacerts/ca_cert.pem' failed Apr 2 15:18:16 00[CFG] loading aa certificates from '/etc/strongswan/ipsec.d/aacerts' Apr 2 15:18:16 00[LIB] opening directory '/etc/strongswan/ipsec.d/aacerts' failed: No such file or directory Apr 2 15:18:16 00[CFG] reading directory failed Apr 2 15:18:16 00[CFG] loading ocsp signer certificates from '/etc/strongswan/ipsec.d/ocspcerts' Apr 2 15:18:16 00[LIB] opening directory '/etc/strongswan/ipsec.d/ocspcerts' failed: No such file or directory Apr 2 15:18:16 00[CFG] reading directory failed Apr 2 15:18:16 00[CFG] loading attribute certificates from '/etc/strongswan/ipsec.d/acerts' Apr 2 15:18:16 00[LIB] opening directory '/etc/strongswan/ipsec.d/acerts' failed: No such file or directory Apr 2 15:18:16 00[CFG] reading directory failed Apr 2 15:18:16 00[CFG] loading crls from '/etc/strongswan/ipsec.d/crls' Apr 2 15:18:16 00[CFG] loading secrets from '/etc/strongswan/ipsec.secrets' Apr 2 15:18:16 00[ASN] file content is not binary ASN.1 Apr 2 15:18:16 00[ASN] -----BEGIN EC PRIVATE KEY----- Apr 2 15:18:16 00[ASN] -----END EC PRIVATE KEY----- Apr 2 15:18:16 00[ASN] L0 - encryptedPrivateKeyInfo: Apr 2 15:18:16 00[ASN] L1 - encryptionAlgorithm: Apr 2 15:18:16 00[ASN] L2 - algorithmIdentifier: ASN1 tag 0x30 expected, but is 0x02 Apr 2 15:18:16 00[ASN] L0 - privateKeyInfo: Apr 2 15:18:16 00[ASN] L1 - version: Apr 2 15:18:16 00[ASN] L1 - privateKeyAlgorithm: Apr 2 15:18:16 00[ASN] L2 - algorithmIdentifier: ASN1 tag 0x30 expected, but is 0x04 Apr 2 15:18:16 00[LIB] building CRED_PRIVATE_KEY - ECDSA failed, tried 2 builders Apr 2 15:18:16 00[CFG] loading private key from '/etc/strongswan/ipsec.d/private/outerKey.pem' failed Apr 2 15:18:16 00[LIB] feature PRIVKEY:DSA in 'pem' plugin has unsatisfied dependency: PRIVKEY:DSA Apr 2 15:18:16 00[LIB] feature PUBKEY:ECDSA in 'pem' plugin has unsatisfied dependency: PUBKEY:ECDSA Apr 2 15:18:16 00[LIB] feature PUBKEY:DSA in 'pem' plugin has unsatisfied dependency: PUBKEY:DSA Apr 2 15:18:16 00[LIB] feature CERT_DECODE:X509_OCSP_REQUEST in 'pem' plugin has unsatisfied dependency: CERT_DECODE:X509_OCSP_REQUEST Apr 2 15:18:16 00[DMN] loaded plugins: charon openssl fips-prf aes des sha1 sha2 md5 random nonce x509 pubkey pkcs1 pkcs8 pgp pem gmp xcbc hmac kernel-netlink socket-default stroke updown Apr 2 15:18:16 00[JOB] spawning 16 worker threads Apr 2 15:18:16 01[LIB] created thread 01 [8914] Apr 2 15:18:16 02[LIB] created thread 02 [8915] Apr 2 15:18:16 02[JOB] started worker thread 02 Apr 2 15:18:16 01[JOB] started worker thread 01 Apr 2 15:18:16 03[LIB] created thread 03 [8916] Apr 2 15:18:16 03[JOB] started worker thread 03 Apr 2 15:18:16 05[LIB] created thread 05 [8918] Apr 2 15:18:16 07[LIB] created thread 07 [8920] Apr 2 15:18:16 06[LIB] created thread 06 [8919] Apr 2 15:18:16 08[LIB] created thread 08 [8921] Apr 2 15:18:16 11[LIB] created thread 11 [8924] Apr 2 15:18:16 07[JOB] started worker thread 07 Apr 2 15:18:16 06[JOB] started worker thread 06 Apr 2 15:18:16 05[JOB] started worker thread 05 Apr 2 15:18:16 10[LIB] created thread 10 [8923] Apr 2 15:18:16 10[JOB] started worker thread 10 Apr 2 15:18:16 04[LIB] created thread 04 [8917] Apr 2 15:18:16 04[JOB] started worker thread 04 Apr 2 15:18:16 09[LIB] created thread 09 [8922] Apr 2 15:18:16 09[JOB] started worker thread 09 Apr 2 15:18:16 11[JOB] started worker thread 11 Apr 2 15:18:16 15[LIB] created thread 15 [8928] Apr 2 15:18:16 15[JOB] started worker thread 15 Apr 2 15:18:16 16[LIB] created thread 16 [8929] Apr 2 15:18:16 16[JOB] started worker thread 16 Apr 2 15:18:16 14[LIB] created thread 14 [8927] Apr 2 15:18:16 14[JOB] started worker thread 14 Apr 2 15:18:16 02[JOB] no events, waiting Apr 2 15:18:16 05[NET] waiting for data on sockets Apr 2 15:18:16 08[JOB] started worker thread 08 Apr 2 15:18:16 13[LIB] created thread 13 [8926] Apr 2 15:18:16 12[LIB] created thread 12 [8925] Apr 2 15:18:16 12[JOB] started worker thread 12 Apr 2 15:18:16 13[JOB] started worker thread 13 Apr 2 15:18:16 04[CFG] received stroke: add connection 'device-outer-tunnel' Apr 2 15:18:16 04[CFG] conn device-outer-tunnel Apr 2 15:18:16 04[CFG] left=10.50.102.17 Apr 2 15:18:16 04[CFG] leftsubnet=10.50.102.16/28 Apr 2 15:18:16 04[CFG] leftsourceip=(null) Apr 2 15:18:16 04[CFG] leftauth=pubkey Apr 2 15:18:16 04[CFG] leftauth2=(null) Apr 2 15:18:16 04[CFG] leftid=(null) Apr 2 15:18:16 04[CFG] leftid2=(null) Apr 2 15:18:16 04[CFG] leftrsakey=(null) Apr 2 15:18:16 04[CFG] leftcert=ecdsaReq_cert.pem Apr 2 15:18:16 04[CFG] leftcert2=(null) Apr 2 15:18:16 04[CFG] leftca=(null) Apr 2 15:18:16 04[CFG] leftca2=(null) Apr 2 15:18:16 04[CFG] leftgroups=(null) Apr 2 15:18:16 04[CFG] leftupdown=(null) Apr 2 15:18:16 04[CFG] right=%any Apr 2 15:18:16 04[CFG] rightsubnet=(null) Apr 2 15:18:16 04[CFG] rightsourceip=(null) Apr 2 15:18:16 04[CFG] rightauth=pubkey Apr 2 15:18:16 04[CFG] rightauth2=(null) Apr 2 15:18:16 04[CFG] rightid=C=US, ST=Texas, L=City, O=Company, OU=Engineering, CN=ca.company.com Apr 2 15:18:16 04[CFG] rightid2=(null) Apr 2 15:18:16 04[CFG] rightrsakey=(null) Apr 2 15:18:16 04[CFG] rightcert=(null) Apr 2 15:18:16 04[CFG] rightcert2=(null) Apr 2 15:18:16 04[CFG] rightca=(null) Apr 2 15:18:16 04[CFG] rightca2=(null) Apr 2 15:18:16 04[CFG] rightgroups=(null) Apr 2 15:18:16 04[CFG] rightupdown=(null) Apr 2 15:18:16 04[CFG] eap_identity=(null) Apr 2 15:18:16 04[CFG] aaa_identity=(null) Apr 2 15:18:16 04[CFG] xauth_identity=(null) Apr 2 15:18:16 04[CFG] ike=aes128-sha1-modp2048,3des-sha1-modp1536 Apr 2 15:18:16 04[CFG] esp=aes128-sha1-modp2048,3des-sha1-modp1536 Apr 2 15:18:16 04[CFG] dpddelay=30 Apr 2 15:18:16 04[CFG] dpdtimeout=150 Apr 2 15:18:16 04[CFG] dpdaction=0 Apr 2 15:18:16 04[CFG] closeaction=0 Apr 2 15:18:16 04[CFG] mediation=no Apr 2 15:18:16 04[CFG] mediated_by=(null) Apr 2 15:18:16 04[CFG] me_peerid=(null) Apr 2 15:18:16 04[CFG] keyexchange=ikev2 Apr 2 15:18:16 04[KNL] getting interface name for %any Apr 2 15:18:16 04[KNL] %any is not a local address Apr 2 15:18:16 04[KNL] getting interface name for 10.50.102.17 Apr 2 15:18:16 04[KNL] 10.50.102.17 is not a local address Apr 2 15:18:16 04[CFG] left nor right host is our side, assuming left=local Apr 2 15:18:16 04[ASN] file content is not binary ASN.1 Apr 2 15:18:16 04[ASN] -----BEGIN CERTIFICATE----- Apr 2 15:18:16 04[ASN] -----END CERTIFICATE----- Apr 2 15:18:16 04[LIB] OpenSSL X.509 parsing failed Apr 2 15:18:16 04[ASN] L0 - x509: Apr 2 15:18:16 04[ASN] L1 - tbsCertificate: Apr 2 15:18:16 04[ASN] L2 - DEFAULT v1: Apr 2 15:18:16 04[ASN] X.509v1 Apr 2 15:18:16 04[ASN] L2 - serialNumber: Apr 2 15:18:16 04[ASN] L2 - signature: Apr 2 15:18:16 04[ASN] L3 - algorithmIdentifier: Apr 2 15:18:16 04[ASN] L4 - algorithm: Apr 2 15:18:16 04[ASN] 'ecdsa-with-SHA384' Apr 2 15:18:16 04[ASN] L2 - issuer: Apr 2 15:18:16 04[ASN] 'C=US, ST=Texas, L=City, O=Company, OU=Engineering, CN=ca.company.com' Apr 2 15:18:16 04[ASN] L2 - validity: Apr 2 15:18:16 04[ASN] L3 - notBefore: Apr 2 15:18:16 04[ASN] L4 - utcTime: Apr 2 15:18:16 04[ASN] 'Apr 02 14:30:33 UTC 2013' Apr 2 15:18:16 04[ASN] L3 - notAfter: Apr 2 15:18:16 04[ASN] L4 - utcTime: Apr 2 15:18:16 04[ASN] 'Apr 02 14:30:33 UTC 2014' Apr 2 15:18:16 04[ASN] L2 - subject: Apr 2 15:18:16 04[ASN] 'C=US, ST=Texas, L=City, O=Company, OU=Engineering, CN=10.50.102.44' Apr 2 15:18:16 04[ASN] L2 - subjectPublicKeyInfo: Apr 2 15:18:16 04[ASN] -- > -- Apr 2 15:18:16 04[ASN] L0 - subjectPublicKeyInfo: Apr 2 15:18:16 04[ASN] L1 - algorithm: Apr 2 15:18:16 04[ASN] L2 - algorithmIdentifier: Apr 2 15:18:16 04[ASN] L3 - algorithm: Apr 2 15:18:16 04[ASN] 'id-ecPublicKey' Apr 2 15:18:16 04[ASN] L3 - parameters: Apr 2 15:18:16 04[ASN] -- < -- Apr 2 15:18:16 04[LIB] building CRED_CERTIFICATE - ANY failed, tried 1 builders Apr 2 15:18:16 04[CFG] loading certificate from 'ecdsaReq_cert.pem' failed Apr 2 15:18:16 04[CFG] added configuration 'device-outer-tunnel'
_______________________________________________ Users mailing list [email protected] https://lists.strongswan.org/mailman/listinfo/users
