Re: [Users] Authentication problems FreeSWAN + X509 and W2K/XP Clients

In oakley.log you'v got the erro message

  2-21: 09:35:39:108 Error 0 during CryptVerifySignature!

Probably FreeS/WAN's signature using its private RSA key does not match the public key in FreeS/WAN's certificate. Instead of using the deprecated /etc/x509cert.der, use

   leftcert=freeswanCert.pem

or

   leftcert=freeswanCert.der

in ipsec.conf. In ipsec.secrets load the private key via

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related lists.freeswan.org Links 1998-fall 1998-spring 1998-summer 1998-winter 1999-winter announce briefs bugs design freeswan-list hipsec ietf-sectest users users-admin Request more information about Pantek

   : RSA freeswanKey.pem "<optional password>

Then execute

   ipsec auto --listcerts

and check if FreeS/WAN's certificate has the entry

   , has private key

If this is not the case then the private key loaded via ipsec.secrets does not match the public key in ipsec.secrets.

Regards

Andreas

Do you need more help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related lists.freeswan.org Links 1998-fall 1998-spring 1998-summer 1998-winter 1999-winter announce briefs bugs design freeswan-list hipsec ietf-sectest users users-admin Request more information about Pantek

Kallabis, Marcus wrote:
> Hi,
> I've some problems to set up an ipsec connection betweeen a linux box

-- 
=======================================================================
Andreas Steffen                   e-mail: andreas.steffen@strongsec.com
strongSec GmbH                    home:   
http://www.strongsec.com
Alter Zürichweg 20                phone:  +41 1 730 80 64
CH-8952 Schlieren (Switzerland)   fax:    +41 1 730 80 65
==========================================[strong internet security]===


_______________________________________________
Users mailing list
Users@lists.freeswan.org
http://lists.freeswan.org/mailman/listinfo/users