Thank you for your answer. Here is the log: root@127.0.0.1:~$ ipsec up lap1 initiating IKE_SA lap1[1] to 192.168.10.152 generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ] sending packet: from 172.27.10.142[500] to 192.168.10.152[500] (588 bytes) received packet: from 192.168.10.152[500] to 172.27.10.142[500] (517 bytes) parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(MULT_AUTH) ] received cert request for "O=Firm, CN=Root_CA, C=CN, ST=Land, L=City, E= e...@mail.com, OU=Firm, OU=CA_ROOT" received 3 cert requests for an unknown ca sending cert request for "O=Firm, CN=Root_CA, C=CN, ST=Land, L=City, E= e...@mail.com, OU=Firm, OU=CA_ROOT" authentication of 'CN=EndDeviceName, ST=Land, C=CN, E=e...@mail.com, O=Firm, L=City, OU=UnitName, OU=EndDevices' (myself) with RSA signature successful sending end entity cert "CN=EndDeviceName, ST=Land, C=CN, E=e...@mail.com, O=Firm, L=City, OU=UnitName, OU=EndDevices" establishing CHILD_SA lap1 generating IKE_AUTH request 1 [ IDi CERT CERTREQ AUTH SA TSi TSr N(MULT_AUTH) N(EAP_ONLY) ] sending packet: from 172.27.10.142[500] to 192.168.10.152[500] (2165 bytes) received packet: from 192.168.10.152[500] to 172.27.10.142[500] (5295 bytes) parsed IKE_AUTH response 1 [ IDr CERT CERT CERT AUTH SA TSi TSr N(AUTH_LFT) ] received end entity cert "CN=GateName, ST=Land, C=CN, E=e...@mail.com, O=Firm, L=City, OU=UnitName, OU=EndDevices" received issuer cert "CN=Master, ST=Land, C=CN, E=e...@mail.com, O=Firm, L=City, OU=UnitName, OU=Master" received issuer cert "CN=Signing_CA, ST=Land, C=CN, E=e...@mail.com, O=Firm, L=City, OU=Firm, OU=SIGNING_CA" using certificate "CN=GateName, ST=Land, C=CN, E=e...@mail.com, O=Firm, L=City, OU=UnitName, OU=EndDevices" using untrusted intermediate certificate "CN=Master, ST=Land, C=CN, E= e...@mail.com, O=Firm, L=City, OU=UnitName, OU=Master" checking certificate status of "CN=GateName, ST=Land, C=CN, E=e...@mail.com, O=Firm, L=City, OU=UnitName, OU=EndDevices" certificate status is not available using untrusted intermediate certificate "CN=Signing_CA, ST=Land, C=CN, E= e...@mail.com, O=Firm, L=City, OU=Firm, OU=SIGNING_CA" checking certificate status of "CN=Master, ST=Land, C=CN, E=e...@mail.com, O=Firm, L=City, OU=UnitName, OU=Master" certificate status is not available using trusted ca certificate "O=Firm, CN=Root_CA, C=CN, ST=Land, L=City, E=e...@mail.com, OU=Firm, OU=CA_ROOT" checking certificate status of "CN=Signing_CA, ST=Land, C=CN, E=e...@mail.com, O=Firm, L=City, OU=Firm, OU=SIGNING_CA" certificate status is not available reached self-signed root ca with a path length of 2 authentication of 'CN=GateName, ST=Land, C=CN, E=e...@mail.com, O=Firm, L=City, OU=UnitName, OU=EndDevices' with RSA signature successful IKE_SA lap1[1] established between 172.27.10.142[CN=EndDeviceName, ST=Land, C=CN, E=e...@mail.com, O=Firm, L=City, OU=UnitName, OU=EndDevices]...192.168.10.152[CN=GateName, ST=Land, C=CN, E=e...@mail.com, O=Firm, L=City, OU=UnitName, OU=EndDevices] scheduling reauthentication in 6694s maximum IKE_SA lifetime 6994s connection 'lap1' established successfully root@127.0.0.1:~$
as I was doing many experiments, current log is from scenario where: rightid="%any" rightca="CN=aa, ST=aa, C=aa, E=aa, O=aa, L=aa, OU=aa, OU=aa" Are these logs enough for you? Of course I've changed the data taken from certs showed in log but I've done this consistently. Are there any log or info accessible informing that rightca is checked during authentication process? Regards, John 2016-11-23 19:50 GMT+01:00 Andreas Steffen <andreas.stef...@strongswan.org>: > Hi John, > > could you send me a log file showing that a CA different from the CA > requested by rightca is accepted? > > Best regards > > Andreas > > On 23.11.2016 16:41, John Brown wrote: > >> Hello all, >> >> I'm using Linux strongSwan U5.2.1/K3.4.112 and I'm trying to implement >> rightca option in ipsec.conf file but without a success. >> >> As far as I understand the documentation, if rightca contains DN of a >> certificate authority which lies in the trust path from the end device >> cert to rootca, authentication process will pass (assuming that other >> elements are configured fine) otherwise will fail and this is the >> functionality I need. But in my scenario, whatever is the value of >> rightca, the authentication process pass with success. >> >> I've put rightca on the initiator of IKEv2 tunnel, root ca chain path >> lenght is 2 (root ca->sub1->sub2->end device cert). Currently only root >> ca is installed in /etc/ipsec.d/cacerts. >> >> Part of the connection config: >> >> conn lap1 >> auto=add >> left=%any >> right=192.168.1.1 >> rightsubnet=10.0.0.0/24 <http://10.0.0.0/24> >> ... >> leftauth=pubkey >> rightauth=pubkey >> leftcert=cert.crt >> rightid="CN=*, ST=Stttt, C=Cccc, E=E@eeee, O=Oooooo, L=Lllllll, >> OU=*, OU=Ouuuuuu" >> rightca="CN=aa, ST=aa, C=aa, E=aa, O=aa, L=aa, OU=aa, OU=aa" >> >> I've changed values of fields in righid, but rightca is taken from real >> config without modification. >> >> I'm probably missing something obvious, or does not understand this >> feature, but I have no idea, what this can be. >> >> Does anybody knows? >> >> Best regards, >> John, >> > > ====================================================================== > Andreas Steffen andreas.stef...@strongswan.org > strongSwan - the Open Source VPN Solution! www.strongswan.org > Institute for Internet Technologies and Applications > University of Applied Sciences Rapperswil > CH-8640 Rapperswil (Switzerland) > ===========================================================[ITA-HSR]== > >
_______________________________________________ Users mailing list Users@lists.strongswan.org https://lists.strongswan.org/mailman/listinfo/users