Re: a question about x509cert exchange

yli wrote:
> Hello,
>  
> There is problem torturing me for two days. I don't know whether the 
> hosts needed to exchange their certificate if they built one secure 
> channel between them based on x509cert. If I designed ipsec.conf for two 
> hosts like following, I always got error;
>  
> "no RSA public key known for (ip address of peer)"

What is the reason of the failure. There must be some additional
error messages in the log. Have you installed the CA certificate
in /etc/ipsec.d/cacerts?

> ipsec.conf for host (10.10.10.112)
>     config setup
>         interfaces=%defaultroute
>         klipsdebug=none
>         plutodebug=none
>         plutoload=%search
>         plutostart=%search
>         uniqueids=yes
> 
>     conn %default
>         keyingtries=1
>         compress=yes
>         disablearrivalcheck=no
>         authby=rsasig
>         leftrsasigkey=%cert
>         rightrsasigkey=%cert
> 
>     conn one-one
>         right=10.10.10.114
>         rightid="####"
>         #don't install certificate of 10.10.10.114 in 10.10.10.12
>         #rightcert=x509cert_no3.der
>         # local host is left
>         left=10.10.10.112
>         leftcert=x509cert_no1.der
>         auto=add
>         pfs=yes
> 
> ipsec.conf for host (10.10.10.114)
>     config setup
>         interfaces=%defaultroute
>         klipsdebug=none
>         plutodebug=none
>         plutoload=%search
>         plutostart=%search
>         uniqueids=yes
> 
>     conn %default
>         keyingtries=0
>         compress=yes
>         disablearrivalcheck=no
>         authby=rsasig
>         leftrsasigkey=%cert
>         rightrsasigkey=%cert
> 
>     conn one-one
>         left=10.10.10.112
>         leftcert=x509cert_no1.der
>         right=10.10.10.114
>         rightcert=x509cert_no3.der
>         auto=add
>         pfs=yes

Regards

Andreas

=======================================================================
Andreas Steffen                   e-mail: [email protected]
strongSec GmbH                    home:   http://www.strongsec.com
Alter Zürichweg 20                phone:  +41 1 730 80 64
CH-8952 Schlieren (Switzerland)   fax:    +41 1 730 80 65
==========================================[strong internet security]===