Hello Phil, No, that's not the problem. It's because the CA screwed up the settings of the X509 policy mapping extension. I don't quite know the details of /what/ they got wrong, but as far as I can tell, the CA certificate is either missing the extension value that allows any policy or has INHIBIT_ANY_POLICY set.
Kind regards Noel On 16.05.2018 14:10, Phil Frost wrote: > It doesn't appear you've configured strongswan to trust any CAs anywhere. See > /etc/ipsec.d/cacerts, the "CA SECTIONS" section in ipsec.conf(5), and the > leftca and rightca options. > > On Wed, May 16, 2018 at 9:40 AM Michal Grzelak <[email protected] > <mailto:[email protected]>> wrote: > > I have a Site to Site VPN between Strongswan and Cisco working over PSK. > Wanted to upgrade it to authenticate via Certificates, but can't get it done. > Receiving following error: > > > |May 9 13:57:20 strongswan charon: 13[CFG] ocsp response correctly signed > by "C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., CN=Go Daddy Root > Validation Authority - G2" May 9 13:57:20 strongswan charon: 13[CFG] ocsp > response is valid: until May 11 01:05:00 2018 May 9 13:57:20 strongswan > charon: 13[CFG] using cached ocsp response May 9 13:57:20 strongswan charon: > 13[CFG] certificate status is good May 9 13:57:20 strongswan charon: 13[CFG] > certificate policy 2.16.840.1.114413.1.7.23.1 for 'OU=Domain Control > Validated, CN=hostname.somedomain.com <http://hostname.somedomain.com>' not > allowed by trustchain, ignored May 9 13:57:20 strongswan charon: 13[CFG] > certificate policy 2.23.140.1.2.1 for 'OU=Domain Control Validated, > CN=hostname.somedomain.com <http://hostname.somedomain.com>' not allowed by > trustchain, ignored May 9 13:57:20 strongswan charon: 13[CFG] reached > self-signed root ca with a path length of 1 May 9 13:57:20 strongswan charon: > 13[IKE] signature > validation failed, looking for another key | > > The Certificates for both ends are signed by two different CA, but > already exchanged public root and intermediate certs. On cisco side I see the > tunnel goes up for both Phase 1 and 2, so its good. Strongswan has problem > with it and no SA is up. > > Configuration: > > |conn testconn auto=start left=%any leftfirewall=yes > [email protected] <http://strongswan.mydomain.com> > leftid=x.x.x.x leftcert=strongswan.mydomain.com.pem right=y.y.y.y > rightid=%any [email protected] > <http://hostname.somedomain.com> type=tunnel ikelifetime=24h keylife=1h > esp=aes256-sha384-ecp521 ike=aes256-sha384-modp1024 keyingtries=%forever > keyexchange=ikev2 leftsubnet=z.z.z.z/z rightsubnet=u.u.u.u/u dpddelay=10s > dpdtimeout=30s dpdaction=restart | > > What be wrong here? Any suggestions? > > Thanks. > > > -- > Best regards, > Michał >
signature.asc
Description: OpenPGP digital signature
