(racoon2 56) [BOUNCED ] Re: [Ipsec-tools-devel] problems of configuring racoon2 using rsasig
Shoichi Sakane <[email protected]> Fri, 24 Feb 2006 08:13:07 +0900
| Newsgroups | gmane.network.ipv6.kame.racoon |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format. --------------020302070001020100010605 Content-Type: text/plain; charset=ISO-2022-JP Content-Transfer-Encoding: 7bit --------------020302070001020100010605 Content-Type: message/rfc822; name="=?UTF-8?B?Qk9VTkNFIHJhY29vbjJAb3JhbmdlLmthbWUubmV0OiAgICBOb24tbWVtYmVyIHN1?==?UTF-8?B?Ym1pc3Npb24gZnJvbSBbIu+/vSIgPHJ1bm5pbmcuZGN5QGdtYWlsLmNvbT5d?=" Content-Transfer-Encoding: 7bit Content-Disposition: inline; filename="=?UTF-8?B?Qk9VTkNFIHJhY29vbjJAb3JhbmdlLmthbWUubmV0OiAgICBOb24tbWVtYmVyIHN1?==?UTF-8?B?Ym1pc3Npb24gZnJvbSBbIu+/vSIgPHJ1bm5pbmcuZGN5QGdtYWlsLmNvbT5d?=" Return-Path: <[email protected]> X-Original-To: [email protected] Delivered-To: [email protected] Received: by mama.tanu.org (Postfix, from userid 1003) id E65231A7C1C; Fri, 24 Feb 2006 01:34:31 +0900 (JST) Received: from orange.kame.net (orange.kame.net [203.178.141.194]) by mama.tanu.org (Postfix) with ESMTP id 28CD61A7C19 for <[email protected]>; Fri, 24 Feb 2006 01:34:29 +0900 (JST) Received: by orange.kame.net (Postfix) id B903E356767; Fri, 24 Feb 2006 01:34:28 +0900 (JST) Delivered-To: [email protected] Received: by orange.kame.net (Postfix, from userid 54) id 91A0935677A; Fri, 24 Feb 2006 01:34:28 +0900 (JST) To: [email protected] From: [email protected] Subject: BOUNCE [email protected]: Non-member submission from ["=?GB2312?B?tsW0utHg?=" <[email protected]>] Message-Id: <[email protected]> Date: Fri, 24 Feb 2006 01:34:28 +0900 (JST) From [email protected] Fri Feb 24 01:34:28 2006 Return-Path: <[email protected]> X-Original-To: [email protected] Delivered-To: [email protected] Received: from sardine.kame.net (sardine.kame.net [2001:200:0:8002:210:f3ff:fe03:4d0]) by orange.kame.net (Postfix) with ESMTP id 06886356767 for <[email protected]>; Fri, 24 Feb 2006 01:34:28 +0900 (JST) Received: from xproxy.gmail.com (xproxy.gmail.com [66.249.82.204]) by sardine.kame.net (Postfix) with ESMTP id 5F420914 for <[email protected]>; Fri, 24 Feb 2006 01:31:27 +0900 (JST) Received: by xproxy.gmail.com with SMTP id h26so72762wxd for <[email protected]>; Thu, 23 Feb 2006 08:33:53 -0800 (PST) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:references; b=iaNmCVNPoL66uANzloxlHFON/1/Zve69mJl+D2dc2HGDMaPqPy6qmF/g0s/s+wWoh/4f6OBovpRXLEuOWi2I+g1utWo02KmQsNwzuId+xLLH7dUeQAYYV1Oq1WiuA6J0CXyi7qnAXwC68PSUhxNodkQ+GX4ooep5ifZU8u7gVGg= Received: by 10.70.86.7 with SMTP id j7mr342589wxb; Thu, 23 Feb 2006 06:44:20 -0800 (PST) Received: by 10.70.35.10 with HTTP; Thu, 23 Feb 2006 06:44:20 -0800 (PST) Message-ID: <[email protected]> Date: Thu, 23 Feb 2006 22:44:20 +0800 From: "=?GB2312?B?tsW0utHg?=" <[email protected]> To: "Brian Candler" <[email protected]> Subject: Re: [Ipsec-tools-devel] problems of configuring racoon2 using rsasig Cc: [email protected], [email protected] In-Reply-To: <[email protected]> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_2372_24334427.1140705860024" References: <[email protected]> <[email protected]> ------=_Part_2372_24334427.1140705860024 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Content-Disposition: inline 2006/2/22, Brian Candler [email protected]: > > > > You haven't made it clear - are you trying to authenticate using RSA keys > only (i.e. you install the other side's RSA public key at your own side)? > Or > are you using certificates (in which case you have built a root CA, and > you > install the root CA's certificate at both sides, as well as the local > side's > certificate signed by the same CA) I want to use certificates for authentication. Here is some steps of generating X.509 certificates with openssl: First, create my certificate authority(use the command "/usr/share/ssl/misc/CA -newca").Then there are cacert.pem and cakey.pem. Then,create a cerficate for SG158, using command "/usr/share/ssl/misc/CA -newreq" and "/usr/share/ssl/misc/CA -sign". Then there are sg158_cert.pem and sg158_key.pem. By the same way, create sg164_cert.pem and sg164_key.pem for SG164.The contents of two certs is attached as AppendixA. After that I put cacert.pem, cakey.pem, sg158_cert.pem, sg164_cert.pem at both side(exactly /usr/local/racoon2/etc/cert/), and sg158_key.pem at SG158, sg164_key.pem at SG164 respectively. Last, use the magic word "ln -s cacert.pem `openssl x509 -hash -noout -in cacert.pem`.0", same for sg158_cert.pem and sg164_cert.pem. So, the content of /usr/local/racoon2/etc/cert/ at SG158 includes: [root@SG158 cert]# ls 3ff121bd.0 7141d0f7.0 demoCA sg158_key.pem 5985ea56.0 cacert.pem sg158_cert.pem sg164_cert.pem the content of /usr/local/racoon2/etc/cert/ at SG164 includes: [root@SG164 cert]# ls 3ff121bd.0 7141d0f7.0 demoCA sg164_key.pem 5985ea56.0 cacert.pem sg158_cert.pem sg164_cert.pem You'll need to post your complete config files for both sides, plus what > steps you did you make valid certificates. The above trace seems to > indicate > that the root CA certificate couldn't be found. The racoon2.conf of SG158 is as follows: setval { PSKDIR "/usr/local/racoon2/etc/psk"; CERTDIR "/usr/local/racoon2/etc/cert"; }; #interface info interface { # specify the I/F spmd { unix "/usr/local/racoon2/run/spmif"; }; spmd_password "${PSKDIR}/psk"; ike { 210.29.174.158; }; #ike { 192.168.100.0/24; }; }; remote SG164.test { acceptable_kmp { ikev2; }; ikev2 { peers_ipaddr 210.29.174.164 port 500; peers_id x509_subject "/C=3DCN/ST=3DJS/L=3DSZ/O=3DSUDA/OU=3DCSTS/CN=3DZXM/emailAddress=3D2 [email protected]"; my_id x509_subject "/C=3DCN/ST=3DJS/L=3DSZ/O=3DSUDA/OU=3DCSTS/CN=3DDCY/emailAddress=3D2 [email protected]"; #my_id fqdn "210.29.174.159"; kmp_enc_alg { 3des_cbc; }; # 3des_cbc, aes128_cbc, aes192_cbc, aes256_cbc kmp_prf_alg { hmac_md5; }; # hmac_md5, hmac_sha1, aes_xcbc kmp_hash_alg { hmac_sha1; }; # hmac_md5, hmac_sha1, aes_xcbc kmp_dh_group { 5; }; # modp768, modp1024, modp1536, # modp2048, modp3072, modp4096, # modp6144, modp8192 # (or corresponding numbers= ) #kmp_auth_method {psk; }; kmp_auth_method { rsasig; }; # psk, rsasig, dss #if kmp_auth_method is psk, specify pre_shared_key #pre_shared_key "${PSKDIR}/psk"; verify_pubkey off; my_public_key x509pem "${CERTDIR}/sg158_cert.pem" "${CERTDIR}/sg158_key.pem"; peers_public_key x509pem "${CERTDIR}/sg164_cert.pem" ""; }; }; selector 31 { direction outbound; #src 210.29.174.158; #dst 210.29.174.164; src 192.168.100.0/24; dst 192.168.132.0/24; upper_layer_protocol "icmp"; policy_index SG164.test; }; selector 32 { direction inbound; #src 210.29.174.164; #dst 210.29.174.158; src 192.168.132.0/24; dst 192.168.100.0/24; upper_layer_protocol "icmp"; policy_index SG164.test; }; #rightid=3D"C=3DCN, ST=3DJS, L=3DSZ, O=3DSUDA, OU=3DCSTS, CN=3DVPNGW" policy SG164.test { action auto_ipsec; remote_index SG164.test; #ipsec_mode transport; ipsec_mode tunnel; ipsec_index { ipsec_esp; }; ipsec_level unique; peers_sa_ipaddr 210.29.174.164; my_sa_ipaddr 210.29.174.158; }; ipsec ipsec_ah_esp { ipsec_sa_lifetime_time 28800 sec; sa_index { ah_01; esp_01; }; }; ipsec ipsec_esp { ipsec_sa_lifetime_time 28800 sec; sa_index esp_01; }; sa ah_01 { sa_protocol ah; ah_auth_alg { hmac_sha1; hmac_md5; }; }; sa esp_01 { sa_protocol esp; esp_enc_alg { aes128_cbc; 3des_cbc; }; esp_auth_alg { hmac_sha1; hmac_md5; }; }; The racoon2.conf of SG164 is as follows: setval { PSKDIR "/usr/local/racoon2/etc/psk"; CERTDIR "/usr/local/racoon2/etc/cert"; }; #interface info interface { # specify the I/F spmd { unix "/usr/local/racoon2/run/spmif"; }; spmd_password "${PSKDIR}/psk"; ike { 210.29.174.164; }; #ike { 192.168.100.0/24; }; }; remote SG158.test { acceptable_kmp { ikev2; }; ikev2 { peers_ipaddr 210.29.174.158 port 500; peers_id x509_subject "C=3DCN,ST=3DJS,L=3DSZ,O=3DSUDA,OU=3DCSTS,CN=3DDCY/emailAddress=3D21 [email protected]"; my_id x509_subject "/C=3DCN/ST=3DJS/L=3DSZ/O=3DSUDA/OU=3DCSTS/CN=3DZXM/emailAddress=3D2 [email protected]"; kmp_enc_alg { 3des_cbc; }; # 3des_cbc, aes128_cbc, aes192_cbc, aes256_cbc kmp_prf_alg { hmac_md5; }; # hmac_md5, hmac_sha1, aes_xcbc kmp_hash_alg { hmac_sha1; }; # hmac_md5, hmac_sha1, aes_xcbc kmp_dh_group { 5; }; # modp768, modp1024, modp1536, # modp2048, modp3072, modp4096, # modp6144, modp8192 # (or corresponding numbers= ) #kmp_auth_method { psk; }; kmp_auth_method { rsasig; }; # psk, rsasig, dss # if kmp_auth_method is psk, specify pre_shared_key #pre_shared_key "${PSKDIR}/psk"; verify_pubkey off; my_public_key x509pem "${CERTDIR}/sg164_cert.pem" "${CERTDIR}/sg164_key.pem"; peers_public_key x509pem "${CERTDIR}/sg158_cert.pem" ""; }; }; selector 31 { direction inbound; #src 210.29.174.158; #dst 210.29.174.164; src 192.168.100.0/24; dst 192.168.132.0/24; upper_layer_protocol "icmp"; policy_index SG158.test; }; selector 32 { direction outbound; #src 210.29.174.164; #dst 210.29.174.158; src 192.168.132.0/24; dst 192.168.100.0/24; upper_layer_protocol "icmp"; policy_index SG158.test; }; #rightid=3D"C=3DCN, ST=3DJS, L=3DSZ, O=3DSUDA, OU=3DCSTS, CN=3DVPNGW" policy SG158.test { action auto_ipsec; remote_index SG158.test; #ipsec_mode transport; ipsec_mode tunnel; ipsec_index { ipsec_esp; }; ipsec_level unique; peers_sa_ipaddr 210.29.174.158; my_sa_ipaddr 210.29.174.164; }; ipsec ipsec_ah_esp { ipsec_sa_lifetime_time 28800 sec; sa_index { ah_01; esp_01; }; }; ipsec ipsec_esp { ipsec_sa_lifetime_time 28800 sec; sa_index esp_01; }; sa ah_01 { sa_protocol ah; ah_auth_alg { hmac_sha1; hmac_md5; }; }; sa esp_01 { sa_protocol esp; esp_enc_alg { aes128_cbc; 3des_cbc; }; esp_auth_alg { hmac_sha1; hmac_md5; }; }; When 192.168.100.2 ping 192.168.132.2,it fails. (topology is (192.168.100.2)---SG158=3D=3D=3D=3D=3DSG164---(192.168.132.2)) Some information of "iked -D 3" from SG158 is as follows: 2006-02-23 20:43:55 [INTERNAL_ERR]: ike_conf.c:772:ike_identifier_data(): 0:? - ?:(nil):failed reading cert ( /C=3DCN/ST=3DJS/L=3DSZ/O=3DSUDA/OU=3DCSTS/CN=3DDCY/emailAddress=3D210313041= @suda.edu.cn) 2006-02-23 20:43:55 [INTERNAL_ERR]: ikev2.c:1801:initiator_state1_send(): 1= : 210.29.174.158[500] - 210.29.174.164[500]:(nil):failed to create IKE_AUTH message My question is how to use subject name of the certificate as ID? Is the syntax as what I wrote in configuration file right? Is the certificates and cressponding keys what I put in /usr/local/racoon2/etc/cert/ correct? Anyone who could tell me the right configuration? Thanks very much. Appendix A: [root@SG158 cert]# less sg158_cert.pem Certificate: Data: Version: 3 (0x2) Serial Number: 1 (0x1) Signature Algorithm: sha1WithRSAEncryption Issuer: C=3DCN, ST=3DJS, L=3DSZ, O=3DSUDA, OU=3DCSTS, CN=3DVPNGW/[email protected] Validity Not Before: Feb 23 08:15:44 2006 GMT Not After : Feb 23 08:15:44 2007 GMT Subject: C=3DCN, ST=3DJS, O=3DSUDA, OU=3DCSTS, CN=3DDCY/[email protected] Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (1024 bit) Modulus (1024 bit): 00:d9:33:65:73:2c:1b:7d:49:54:e6:04:16:49:25: 3e:ac:89:5c:9a:91:49:7b:7e:ae:5c:f3:fb:27:63: 87:3c:95:a6:73:24:8e:9c:93:33:23:75:16:c3:5d: c7:46:4e:76:ff:b3:94:4b:71:23:36:bf:bb:5a:40: 6c:b7:91:d2:7f:3a:ff:6e:79:28:33:1e:0d:ed:6c: c0:c0:4a:b8:29:f7:cc:79:e6:ba:4b:71:ef:e6:3e: a1:f8:7f:8d:de:75:13:2b:7b:f3:86:72:15:65:1a: 92:21:3a:d1:df:a9:fc:d2:69:85:fb:09:c5:2f:b1: 2f:5c:a3:43:1b:b7:e8:9a:5b Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Key Identifier: 03:C8:00:48:A1:52:0B:A6:D7:75:B1:BA:B2:EA:CB:DA:0D:68:CC:CA X509v3 Authority Key Identifier: keyid:B3:2C:63:EA:49:6B:CE:40:CE:5C:48:A1:21:01:22:8C:9B:53:33:A7 DirName:/C=3DCN/ST=3DJS/L=3DSZ/O=3DSUDA/OU=3DCSTS/CN=3DVPNGW/em= ailAddress=3D [email protected] serial:00 X509v3 Basic Constraints: CA:TRUE X509v3 CRL Distribution Points: URI:http://210.29.174.137/CA.crl Signature Algorithm: sha1WithRSAEncryption 79:5e:b0:c7:b2:6b:39:9f:19:b6:f2:8b:c8:d1:2f:6e:c3:1b: 6c:63:ff:b9:57:67:11:af:10:27:b7:b7:05:73:69:89:80:a8: c3:39:f4:fc:49:d5:bb:3e:0e:50:83:f1:f5:cb:b5:39:8c:72: 75:04:77:8b:0a:d4:60:8a:46:5c:88:c6:03:0b:39:3d:94:53: b1:42:85:92:71:49:c7:49:d0:e7:62:13:31:44:af:7a:e9:a5: 66:93:46:96:00:2d:52:22:91:f5:1f:3c:92:ba:dd:d6:35:36: a6:7f:fa:bc:5d:8a:84:8b:4d:c1:11:bf:30:50:cc:89:96:08: 28:ac -----BEGIN CERTIFICATE----- MIIDZzCCAtCgAwIBAgIBATANBgkqhkiG9w0BAQUFADB7MQswCQYDVQQGEwJDTjEL MAkGA1UECBMCSlMxCzAJBgNVBAcTAlNaMQ0wCwYDVQQKEwRTVURBMQ0wCwYDVQQL EwRDU1RTMQ4wDAYDVQQDEwVWUE5HVzEkMCIGCSqGSIb3DQEJARYVcnVubmluZy5k Y3lAZ21haWwuY29tMB4XDTA2MDIyMzA4MTU0NFoXDTA3MDIyMzA4MTU0NFowbDEL MAkGA1UEBhMCQ04xCzAJBgNVBAgTAkpTMQ0wCwYDVQQKEwRTVURBMQ0wCwYDVQQL EwRDU1RTMQwwCgYDVQQDEwNEQ1kxJDAiBgkqhkiG9w0BCQEWFTIxMDMxMzA0MUBz dWRhLmVkdS5jbjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA2TNlcywbfUlU 5gQWSSU+rIlcmpFJe36uXPP7J2OHPJWmcySOnJMzI3UWw13HRk52/7OUS3EjNr+7 WkBst5HSfzr/bnkoMx4N7WzAwEq4KffMeea6S3Hv5j6h+H+N3nUTK3vzhnIVZRqS ITrR36n80mmF+wnFL7EvXKNDG7fomlsCAwEAAaOCAQgwggEEMB0GA1UdDgQWBBQD yABIoVILptd1sbqy6svaDWjMyjCBpQYDVR0jBIGdMIGagBSzLGPqSWvOQM5cSKEh ASKMm1Mzp6F/pH0wezELMAkGA1UEBhMCQ04xCzAJBgNVBAgTAkpTMQswCQYDVQQH EwJTWjENMAsGA1UEChMEU1VEQTENMAsGA1UECxMEQ1NUUzEOMAwGA1UEAxMFVlBO R1cxJDAiBgkqhkiG9w0BCQEWFXJ1bm5pbmcuZGN5QGdtYWlsLmNvbYIBADAMBgNV HRMEBTADAQH/MC0GA1UdHwQmMCQwIqAgoB6GHGh0dHA6Ly8yMTAuMjkuMTc0LjEz Ny9DQS5jcmwwDQYJKoZIhvcNAQEFBQADgYEAeV6wx7JrOZ8ZtvKLyNEvbsMbbGP/ uVdnEa8QJ7e3BXNpiYCowzn0/EnVuz4OUIPx9cu1OYxydQR3iwrUYIpGXIjGAws5 PZRTsUKFknFJx0nQ52ITMUSveumlZpNGlgAtUiKR9R88krrd1jU2pn/6vF2KhItN wRG/MFDMiZYIKKw=3D -----END CERTIFICATE----- [root@SG158 cert]# less sg164_cert.pem Certificate: Data: Version: 3 (0x2) Serial Number: 2 (0x2) Signature Algorithm: sha1WithRSAEncryption Issuer: C=3DCN, ST=3DJS, L=3DSZ, O=3DSUDA, OU=3DCSTS, CN=3DVPNGW/[email protected] Validity Not Before: Feb 23 08:24:13 2006 GMT Not After : Feb 23 08:24:13 2007 GMT Subject: C=3DCN, ST=3DJS, O=3DSUDA, OU=3DCSTS, CN=3DZXM/[email protected] Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (1024 bit) Modulus (1024 bit): 00:d9:f7:c3:6c:8a:64:59:c0:76:5e:9e:06:51:ea: 77:2c:c2:f6:6f:f3:73:52:0c:43:d0:a3:7f:a3:b8: 25:c2:9a:6f:9d:f1:8f:f4:13:6f:ec:83:5e:e5:81: c0:5b:79:f2:45:78:55:38:69:27:e4:e1:62:99:33: 7d:6e:d2:f7:72:98:4c:ae:fb:8e:c8:dd:7b:6b:7b: 59:e0:f9:95:e4:5a:f8:5c:8f:b9:f9:6b:1d:80:5a: 8c:50:43:c3:b7:6a:ae:ff:32:e6:cc:76:37:6a:a7: ef:36:ea:77:36:15:e8:da:6a:6b:e3:0d:42:37:51: da:91:07:28:8b:d1:55:06:07 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Key Identifier: E4:46:CD:AC:4D:40:ED:2E:7F:A5:0B:81:30:42:9B:13:D1:82:85:D9 X509v3 Authority Key Identifier: keyid:B3:2C:63:EA:49:6B:CE:40:CE:5C:48:A1:21:01:22:8C:9B:53:33:A7 DirName:/C=3DCN/ST=3DJS/L=3DSZ/O=3DSUDA/OU=3DCSTS/CN=3DVPNGW/em= ailAddress=3D [email protected] serial:00 X509v3 Basic Constraints: CA:TRUE X509v3 CRL Distribution Points: URI:http://210.29.174.137/CA.crl Signature Algorithm: sha1WithRSAEncryption 56:7e:cc:47:ac:ff:08:27:41:c9:83:2f:3e:e9:ae:44:77:c7: d6:ea:47:fa:1f:c1:2b:e3:38:85:9a:7c:7c:8a:53:73:83:18: 2c:59:7f:ed:6d:03:7a:58:3c:b5:5f:2c:bb:85:81:5c:32:55: d4:48:a4:6b:67:08:fa:a2:6f:e7:b3:55:9c:cf:8c:54:7d:b7: dc:00:76:69:33:7c:c1:a2:cb:e7:93:e0:d7:20:ad:56:73:7f: 26:1d:9d:48:49:7e:52:9a:20:46:4b:f7:e9:f7:08:8a:e5:1d: 1f:02:6b:cc:43:e8:a5:d8:0e:ed:8f:87:26:6c:66:78:88:1e: 45:3a -----BEGIN CERTIFICATE----- MIIDZzCCAtCgAwIBAgIBAjANBgkqhkiG9w0BAQUFADB7MQswCQYDVQQGEwJDTjEL MAkGA1UECBMCSlMxCzAJBgNVBAcTAlNaMQ0wCwYDVQQKEwRTVURBMQ0wCwYDVQQL EwRDU1RTMQ4wDAYDVQQDEwVWUE5HVzEkMCIGCSqGSIb3DQEJARYVcnVubmluZy5k Y3lAZ21haWwuY29tMB4XDTA2MDIyMzA4MjQxM1oXDTA3MDIyMzA4MjQxM1owbDEL MAkGA1UEBhMCQ04xCzAJBgNVBAgTAkpTMQ0wCwYDVQQKEwRTVURBMQ0wCwYDVQQL EwRDU1RTMQwwCgYDVQQDEwNaWE0xJDAiBgkqhkiG9w0BCQEWFTIxMDMxMzEwNUBz dWRhLmVkdS5jbjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA2ffDbIpkWcB2 Xp4GUep3LML2b/NzUgxD0KN/o7glwppvnfGP9BNv7INe5YHAW3nyRXhVOGkn5OFi mTN9btL3cphMrvuOyN17a3tZ4PmV5Fr4XI+5+WsdgFqMUEPDt2qu/zLmzHY3aqfv Nup3NhXo2mpr4w1CN1HakQcoi9FVBgcCAwEAAaOCAQgwggEEMB0GA1UdDgQWBBTk Rs2sTUDtLn+lC4EwQpsT0YKF2TCBpQYDVR0jBIGdMIGagBSzLGPqSWvOQM5cSKEh ASKMm1Mzp6F/pH0wezELMAkGA1UEBhMCQ04xCzAJBgNVBAgTAkpTMQswCQYDVQQH EwJTWjENMAsGA1UEChMEU1VEQTENMAsGA1UECxMEQ1NUUzEOMAwGA1UEAxMFVlBO R1cxJDAiBgkqhkiG9w0BCQEWFXJ1bm5pbmcuZGN5QGdtYWlsLmNvbYIBADAMBgNV HRMEBTADAQH/MC0GA1UdHwQmMCQwIqAgoB6GHGh0dHA6Ly8yMTAuMjkuMTc0LjEz Ny9DQS5jcmwwDQYJKoZIhvcNAQEFBQADgYEAVn7MR6z/CCdByYMvPumuRHfH1upH +h/BK+M4hZp8fIpTc4MYLFl/7W0Delg8tV8su4WBXDJV1Eika2cI+qJv57NVnM+M VH233AB2aTN8waLL55Pg1yCtVnN/Jh2dSEl+UpogRkv36fcIiuUdHwJrzEPopdgO 7Y+HJmxmeIgeRTo=3D -----END CERTIFICATE----- -- Regards, Du Chun-yan [email protected] ------=_Part_2372_24334427.1140705860024 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Content-Disposition: inline <br><br> <div><span class=3D"gmail_quote">2006/2/22, Brian Candler <a href=3D"mailto= :[email protected]">[email protected]</a>:</span> <blockquote class=3D"gmail_quote" style=3D"PADDING-LEFT: 1ex; MARGIN: 0px 0= px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid"><br><br>You haven't made it clea= r - are you trying to authenticate using RSA keys<br>only (i.e. you install= the other side's RSA public key at your own side)? Or <br>are you using certificates (in which case you have built a root CA, and= you<br>install the root CA's certificate at both sides, as well as the loc= al side's<br>certificate signed by the same CA)</blockquote> <div> </div> <div>I want to use certificates for authentication.</div> <div>Here is some steps of generating X.509 certificates with openssl:</div= > <div> First, create my certificate authority(= use the command "/usr/share/ssl/misc/CA -newca").Then there are c= acert.pem and cakey.pem.</div> <div> Then,create a cerficate for SG158, using comm= and "/usr/share/ssl/misc/CA -newreq" and "/usr/share/ssl/mis= c/CA -sign". Then there are sg158_cert.pem and sg158_key.pem. By the s= ame way, create sg164_cert.pem and sg164_key.pem for=20 SG164.The contents of two certs is attached as AppendixA.</div> <div> After that I put cacert.pem, cakey.pem, sg158= _cert.pem, sg164_cert.pem at both side(exactly /usr/local/racoon2/etc/cert/= ), and sg158_key.pem at SG158, sg164_key.pem at SG164 respectively.</div> <div> Last, use the magic word "ln -s cacert.p= em `openssl x509 -hash -noout -in cacert.pem`.0", same for sg158_cert.= pem and sg164_cert.pem.</div> <div> So, the content of /usr/local/racoon2/etc/cert/ at = SG158 includes:</div> <div>[root@SG158 cert]# ls &= nbsp; <br>3ff121bd.0 7141d0f7.0 demoCA&= nbsp; sg158_key.pem &n= bsp; <br>5985ea56.0 cacert.pem sg158_cert.pem sg164_cert.= pem</div> <div> the content of /usr/local/racoon2/etc/cert/ a= t SG164 includes:</div> <div>[root@SG164 cert]# ls<br>3ff121bd.0 7141d0f7.0 demoCA = ; sg164_key.pem<br>5985ea56= .0 cacert.pem sg158_cert.pem sg164_cert.pem<br> </d= iv><br> <blockquote class=3D"gmail_quote" style=3D"PADDING-LEFT: 1ex; MARGIN: 0px 0= px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">You'll need to post your complet= e config files for both sides, plus what<br>steps you did you make valid ce= rtificates. The above trace seems to indicate <br>that the root CA certificate couldn't be found.</blockquote> <div> </div> <div>The racoon2.conf of SG158 is as follows:</div> <div> </div> <div>setval {<br> PSKDIR &q= uot;/usr/local/racoon2/etc/psk";<br> &nbs= p; CERTDIR "/usr/local/racoon2/etc/cert";<br>};<br> <b= r>#interface info<br>interface {<br> &nb= sp; # specify the I/F<br> spmd { = unix "/usr/local/racoon2/run/spmif"; }; <br> spmd_password "${PSKDIR= }/psk";<br> ike { <a href=3D= "http://210.29.174.158">210.29.174.158</a>; };<br> &= nbsp; #ike { <a href=3D"http://192.168.100.0/24">192.168.100.0/= 24</a>; };<br>};<br> <br>remote=20 SG164.test {<br> acceptable_kmp {= ikev2; };<br> ikev2 {<br> &= nbsp; &nbs= p; peers_ipaddr <a href=3D"http://210.29.174.164">2= 10.29.174.164</a> port 500; = <br>  = ; peers_id  = ; x509_subject "/C=3DCN/ST=3DJS/L=3DSZ/O=3DSUD= A/OU=3DCSTS/CN=3DZXM/emailAddress=3D2 <br><a href=3D"mailto:[email protected]">[email protected]</a>";= <br>  = ; my_id &n= bsp; x509_subject "/C=3DCN/ST=3DJS/L=3DSZ/O=3DSUDA/OU=3DCSTS/CN= =3DDCY/emailAddress=3D2<br><a href=3D"mailto:[email protected]"> [email protected]</a>";<br> &nbs= p; #my_id = fqdn "<a href= =3D"http://210.29.174.159">210.29.174.159</a>";<br> &= nbsp; kmp= _enc_alg { 3des_cbc; }; # 3des_cbc, aes128_cb= c, aes192_cbc, aes256_cbc <br>  = ; kmp_prf_alg { hmac_md5; }; = ; # hmac_md5, hmac_sha1, aes_xcbc<br> &n= bsp; kmp_hash_alg &nbs= p; { hmac_sha1; }; # hmac_md5, hmac_sha1, aes_xcbc<br> &nb= sp; = kmp_dh_group { 5; }; = # modp768, modp1024, modp1536, <br>  = ; &n= bsp;  = ; # modp2048, m= odp3072, modp4096,<br>  = ; &n= bsp;  = ; &n= bsp; # modp6144, modp8192<br> &nbs= p; &= nbsp; &nbs= p; &= nbsp; # (or corresponding numbers) <br>  = ; #kmp_auth_method {psk; };<br> &n= bsp; kmp_auth_m= ethod { rsasig; }; # psk, rsasig, dss<br> <br> = #if kmp_= auth_method is psk, specify pre_shared_key<br> <br> &= nbsp; #pr= e_shared_key "${PSKDIR}/psk"; <br>  = ; verify_pubkey off;<br> &nb= sp; my_pu= blic_key x509pem "${CERTDIR}/sg158_cert.pem" "${CERTDIR}/sg1= 58_key.pem";<br> = peers_public_key x509pem "${CERTD= IR}/sg164_cert.pem" ""; <br> };<br>};<br> <br>select= or 31 {<br> direction outbound;<b= r> #src <a href=3D"http://210.29.= 174.158">210.29.174.158</a>;<br> = #dst <a href=3D"http://210.29.174.164">210.29.174.164</a>;<br> &= nbsp; src=20 <a href=3D"http://192.168.100.0/24">192.168.100.0/24</a>;<br> &n= bsp; dst <a href=3D"http://192.168.132.0/24">192.16= 8.132.0/24</a>;<br> upper_layer_p= rotocol "icmp";<br> pol= icy_index SG164.test;<br>};<br> <br>selector 32 {<br> direc= tion inbound;<br> #src <a href=3D= "http://210.29.174.164">210.29.174.164</a>;<br> &nbs= p; #dst <a href=3D"http://210.29.174.158">210.29.174.158</a>;<b= r> src <a href=3D"http://192.168.= 132.0/24"> 192.168.132.0/24</a>;<br> dst <a = href=3D"http://192.168.100.0/24">192.168.100.0/24</a>;<br>  = ; upper_layer_protocol "icmp";<br> &= nbsp; policy_index SG164.test;<br>};<br> = ;<br>#rightid=3D"C=3DCN, ST=3DJS, L=3DSZ, O=3DSUDA, OU=3DCSTS, CN=3DVP= NGW" <br>policy SG164.test {<br> actio= n auto_ipsec;<br> remote_index SG= 164.test;<br> #ipsec_mode transpo= rt;<br> ipsec_mode tunnel;<br>&nb= sp; ipsec_index { ipsec_esp; };<br>&nbs= p; ipsec_level unique; <br> peers_sa_ipaddr <a href=3D"h= ttp://210.29.174.164">210.29.174.164</a>;<br> = my_sa_ipaddr <a href=3D"http://210.29.174.158">210.29.174.158<= /a>;<br> <br>};<br> <br> <br>ipsec ipsec_ah_esp {<br> &= nbsp; ipsec_sa_lifetime_time 28800 sec; <br> sa_index { ah_01; esp_01; };= <br>};<br>ipsec ipsec_esp {<br> i= psec_sa_lifetime_time 28800 sec;<br> &nb= sp; sa_index esp_01;<br>};<br> <br>sa ah_01 {<br> &nb= sp; sa_protocol ah;<br> &nbs= p; ah_auth_alg { hmac_sha1; hmac_md5; }; <br>};<br>sa esp_01 {<br> sa_prot= ocol esp;<br> esp_enc_alg { aes12= 8_cbc; 3des_cbc; };<br> esp_auth_= alg { hmac_sha1; hmac_md5; };<br>};<br> </div> <div>The racoon2.conf of SG164 is as follows:</div> <div> </div> <div>setval {<br> PSKDIR "/u= sr/local/racoon2/etc/psk";<br> &nbs= p; CERTDIR "/usr/local/racoon2/etc/cert";<br>};<br>#interface inf= o<br>interface {<br> # specify th= e I/F<br> spmd { unix "/usr/= local/racoon2/run/spmif"; }; <br> spmd_password "${PSKDIR= }/psk";<br> ike { <a href=3D= "http://210.29.174.164">210.29.174.164</a>; };<br> &= nbsp; #ike { <a href=3D"http://192.168.100.0/24">192.168.100.0/= 24</a>; };<br>};<br> <br>remote=20 SG158.test {<br> acceptable_kmp {= ikev2; };<br> ikev2 {<br> &= nbsp; &nbs= p; peers_ipaddr <a href=3D"http://210.29.174.158">2= 10.29.174.158</a> port 500;<br> &n= bsp; peers_id &n= bsp; x509_subject "C=3DCN,ST=3DJS,L=3DSZ,O=3DSUDA,OU= =3DCSTS,CN=3DDCY/emailAddress=3D21 <br><a href=3D"mailto:[email protected]">[email protected]</a>";<b= r> &= nbsp; my_id &nbs= p; x509_subject "/C=3DCN/ST=3DJS/L=3DSZ/O=3DSUDA/OU=3DCSTS/CN=3D= ZXM/emailAddress=3D2<br><a href=3D"mailto:[email protected]"> [email protected]</a>";<br> &nbs= p; kmp_enc_alg &= nbsp; { 3des_cbc; }; # 3des_cbc, aes128_cbc, aes192_cbc, aes256= _cbc<br> &= nbsp; kmp_prf_alg { hmac_md5; };&= nbsp; # hmac_md5, hmac_sha1, aes_xcbc<br> &nbs= p; kmp_hash_alg = { hmac_sha1; }; # hmac_md5, hmac_sha1, aes_xcbc <br>  = ; kmp_dh_group { 5; };  = ; # modp768, modp1024, modp1536,<br> &nb= sp; = &nb= sp; = # modp2048, modp3072, modp= 4096,<br> = &nb= sp; = # modp61= 44, modp8192 <br>  = ; &n= bsp;  = ; # (or corresp= onding numbers)<br> &n= bsp; #kmp_auth_method { psk; };<br> &nbs= p; &= nbsp; kmp_auth_method { rsasig; }; # psk, rsasig, dss<br> <br> &n= bsp;  = ; # if kmp_auth_method is psk, specify pre_shared_key <br> <br> &= nbsp; #pre_shared_key "${PSKDIR}/psk&quo= t;;<br> &n= bsp; verify_pubkey off;<br> = my= _public_key x509pem "${CERTDIR}/sg164_cert.pem" "${CERTDIR}/= sg164_key.pem"; <br>  = ; peers_public_key x509pem "${CERTDIR}/sg158_cert.pe= m" "";<br> };<br>}= ;<br> <br>selector 31 {<br> = direction inbound;<br> #src <a hr= ef=3D"http://210.29.174.158">210.29.174.158 </a>;<br> #dst <a href=3D"http://= 210.29.174.164">210.29.174.164</a>;<br> = src <a href=3D"http://192.168.100.0/24">192.168.100.0/24</a>;<br>&nb= sp; dst <a href=3D"http://192.168.132.0= /24">192.168.132.0/24</a>;<br> up= per_layer_protocol "icmp"; <br> policy_index SG158.test;<br>= };<br> <br>selector 32 {<br> = direction outbound;<br> #src <a = href=3D"http://210.29.174.164">210.29.174.164</a>;<br> &nb= sp; #dst <a href=3D"http://210.29.174.158">210.29.174.158 </a>;<br> src <a href=3D"http://1= 92.168.132.0/24">192.168.132.0/24</a>;<br> &nb= sp; dst <a href=3D"http://192.168.100.0/24">192.168.100.0/24</a>;<br>= upper_layer_protocol "icmp&= quot;;<br> policy_index=20 SG158.test;<br>};<br> <br>#rightid=3D"C=3DCN, ST=3DJS, L=3DSZ, O= =3DSUDA, OU=3DCSTS, CN=3DVPNGW"<br>policy SG158.test {<br> = action auto_ipsec;<br> &nbs= p; remote_index SG158.test;<br> &n= bsp; #ipsec_mode transport;<br> &n= bsp; ipsec_mode tunnel; <br> ipsec_index { ipsec_esp; };<= br> ipsec_level unique;<br> = peers_sa_ipaddr <a href=3D"http://210.= 29.174.158">210.29.174.158</a>;<br> &nbs= p; my_sa_ipaddr <a href=3D"http://210.29.174.164">210.29.174.164</a> ;<br> <br>};<br> <br> <br>ipsec ipsec_ah_esp {<br> &nbs= p; ipsec_sa_lifetime_time 28800 sec;<br> = ; sa_index { ah_01; esp_01; };<br>};<br= >ipsec ipsec_esp {<br> ipsec_sa_l= ifetime_time 28800 sec;<br> sa_in= dex esp_01; <br>};<br> <br>sa ah_01 {<br>  = ; sa_protocol ah;<br> ah_auth_alg= { hmac_sha1; hmac_md5; };<br>};<br>sa esp_01 {<br> = sa_protocol esp;<br> = esp_enc_alg { aes128_cbc; 3des_cbc; };<br> &n= bsp; esp_auth_alg { hmac_sha1; hmac_md5; }; <br>};<br><br>When <a href=3D"http://192.168.100.2">192.168.100.2</a> ping = <a href=3D"http://192.168.132.2">192.168.132.2</a>,it fails.</div> <div>(topology is (<a href=3D"http://192.168.100.2">192.168.100.2</a>)---SG= 158=3D=3D=3D=3D=3DSG164---(<a href=3D"http://192.168.132.2">192.168.132.2</= a>))</div> <div> </div> <div> Some information of "iked -D 3"&nbs= p; from SG158 is as follows:</div> <div>2006-02-23 20:43:55 [INTERNAL_ERR]: ike_conf.c:772:ike_identifier_data= (): 0:? - ?:(nil):failed reading cert (<a>/C=3DCN/ST=3DJS/L=3DSZ/O=3DSUDA/O= U=3DCSTS/CN=3DDCY/[email protected]</a>)<br>2006-02-23 2= 0:43:55 [INTERNAL_ERR]:=20 ikev2.c:1801:initiator_state1_send(): 1:210.29.174.158[500] - 210.29.174.16= 4[500]:(nil):failed to create IKE_AUTH message</div> <div> </div> <div>My question is how to use subject name of the certificate as ID? Is th= e syntax as what I wrote in configuration file right?</div> <div>Is the certificates and cressponding keys what I put in /usr/local/rac= oon2/etc/cert/ correct? Anyone who could tell me the right configurat= ion? Thanks very much.</div> <div> </div> <div>Appendix A:</div> <div>[root@SG158 cert]# less sg158_cert.pem <br>Certificate:<br>  = ; Data:<br> Version: 3 (0x2= )<br> Serial Number: 1 (0x1)<br>&= nbsp; Signature Algorithm: sha1WithRSAE= ncryption<br> Issuer: C=3DCN, ST= =3DJS, L=3DSZ, O=3DSUDA, OU=3DCSTS,=20 <a href=3D"mailto:CN=3DVPNGW/[email protected]">CN=3DVPN= GW/[email protected]</a><br> &nbs= p; Validity<br> = Not Before: Feb 23 08:15:44 2006 GMT<br> &nbs= p; Not After : Feb 23 08:15= :44 2007 GMT <br> Subject: C=3DCN, ST=3DJS, O= =3DSUDA, OU=3DCSTS, <a href=3D"mailto:CN=3DDCY/emailAddress=3D210313041@sud= a.edu.cn">CN=3DDCY/[email protected]</a><br> = Subject Public Key Info:<br> &nbs= p; Public Key Algorithm: rs= aEncryption <br> RSA = Public Key: (1024 bit)<br> &= nbsp; Modulus (1024 bit):<br> &nbs= p; &= nbsp; 00:d9:33:65:73:2c:1b:7d:49:54:e6:04:16:49:25:= <br>  = ; 3e:ac:89:5c:9a:91:49:7b:7e:ae:5= c:f3:fb:27:63:<br> &nb= sp; 87:3c:95:a6:73:24:8e:9c:93:33:23:75= :16:c3:5d:<br> &= nbsp; c7:46:4e:76:ff:b3:94:= 4b:71:23:36:bf:bb:5a:40:<br>  = ; 6c:b7:9= 1:d2:7f:3a:ff:6e:79:28:33:1e:0d:ed:6c:<br> &nb= sp; = c0:c0:4a:b8:29:f7:cc:79:e6:ba:4b:71:ef:e6:3e: <br>  = ; a1:f8:7f:8d:de:75:13:2b:7b:f3:8= 6:72:15:65:1a:<br> &nb= sp; 92:21:3a:d1:df:a9= :fc:d2:69:85:fb:09:c5:2f:b1:<br> &= nbsp; 2f:= 5c:a3:43:1b:b7:e8:9a:5b<br> = Exponent: 65537 (0x10001) <br> X509v3 extensions:<br> = X509v3 Subject= Key Identifier: <br> = 03:C8:00:48:A1:52:0B:A6:D7:75:B1:BA:B2:EA:CB:DA:0D:68:CC:CA<br= > X509v3 = Authority Key Identifier: <br> &nb= sp; keyid:B3:2C:63:EA:49:6B:CE:40:CE:5C:48:A1:21:01:22:8C= :9B:53:33:A7 <br> DirN= ame:/C=3DCN/ST=3DJS/L=3DSZ/O=3DSUDA/OU=3DCSTS/CN=3DVPNGW/emailAddress=3D<a = href=3D"mailto:[email protected]">[email protected]</a><br> &n= bsp; serial:00<br>&nb= sp;<br> X= 509v3 Basic Constraints: <br> &nbs= p; CA:TRUE <br> X509= v3 CRL Distribution Points: <br> &= nbsp; URI:<a href=3D"http://210.29.174.137/CA.crl">http:/= /210.29.174.137/CA.crl</a><br> <br> Signature Algori= thm: sha1WithRSAEncryption<br> 79= :5e:b0:c7:b2:6b:39:9f:19:b6:f2:8b:c8:d1:2f:6e:c3:1b: <br> 6c:63:ff:b9:57:67:11:af:10:2= 7:b7:b7:05:73:69:89:80:a8:<br> c3= :39:f4:fc:49:d5:bb:3e:0e:50:83:f1:f5:cb:b5:39:8c:72:<br> &= nbsp; 75:04:77:8b:0a:d4:60:8a:46:5c:88:c6:03:0b:39:3d:94:= 53:<br> b1:42:85:92:71:49:c7:49:d= 0:e7:62:13:31:44:af:7a:e9:a5: <br> 66:93:46:96:00:2d:52:22:91:f= 5:1f:3c:92:ba:dd:d6:35:36:<br> a6= :7f:fa:bc:5d:8a:84:8b:4d:c1:11:bf:30:50:cc:89:96:08:<br> &= nbsp; 28:ac<br>-----BEGIN CERTIFICATE-----<br>MIIDZzCCAtC= gAwIBAgIBATANBgkqhkiG9w0BAQUFADB7MQswCQYDVQQGEwJDTjEL <br>MAkGA1UECBMCSlMxCzAJBgNVBAcTAlNaMQ0wCwYDVQQKEwRTVURBMQ0wCwYDVQQL<br>EwR= DU1RTMQ4wDAYDVQQDEwVWUE5HVzEkMCIGCSqGSIb3DQEJARYVcnVubmluZy5k<br>Y3lAZ21haW= wuY29tMB4XDTA2MDIyMzA4MTU0NFoXDTA3MDIyMzA4MTU0NFowbDEL<br>MAkGA1UEBhMCQ04xC= zAJBgNVBAgTAkpTMQ0wCwYDVQQKEwRTVURBMQ0wCwYDVQQL <br>EwRDU1RTMQwwCgYDVQQDEwNEQ1kxJDAiBgkqhkiG9w0BCQEWFTIxMDMxMzA0MUBz<br>dWR= hLmVkdS5jbjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA2TNlcywbfUlU<br>5gQWSSU+rI= lcmpFJe36uXPP7J2OHPJWmcySOnJMzI3UWw13HRk52/7OUS3EjNr+7<br>WkBst5HSfzr/bnkoM= x4N7WzAwEq4KffMeea6S3Hv5j6h+H+N3nUTK3vzhnIVZRqS <br>ITrR36n80mmF+wnFL7EvXKNDG7fomlsCAwEAAaOCAQgwggEEMB0GA1UdDgQWBBQD<br>yAB= IoVILptd1sbqy6svaDWjMyjCBpQYDVR0jBIGdMIGagBSzLGPqSWvOQM5cSKEh<br>ASKMm1Mzp6= F/pH0wezELMAkGA1UEBhMCQ04xCzAJBgNVBAgTAkpTMQswCQYDVQQH<br>EwJTWjENMAsGA1UEC= hMEU1VEQTENMAsGA1UECxMEQ1NUUzEOMAwGA1UEAxMFVlBO <br>R1cxJDAiBgkqhkiG9w0BCQEWFXJ1bm5pbmcuZGN5QGdtYWlsLmNvbYIBADAMBgNV<br>HRM= EBTADAQH/MC0GA1UdHwQmMCQwIqAgoB6GHGh0dHA6Ly8yMTAuMjkuMTc0LjEz<br>Ny9DQS5jcm= wwDQYJKoZIhvcNAQEFBQADgYEAeV6wx7JrOZ8ZtvKLyNEvbsMbbGP/<br>uVdnEa8QJ7e3BXNpi= YCowzn0/EnVuz4OUIPx9cu1OYxydQR3iwrUYIpGXIjGAws5 <br>PZRTsUKFknFJx0nQ52ITMUSveumlZpNGlgAtUiKR9R88krrd1jU2pn/6vF2KhItN<br>wRG= /MFDMiZYIKKw=3D<br>-----END CERTIFICATE-----<br> </div> <div> </div> <div>[root@SG158 cert]# less sg164_cert.pem <br>Certificate:<br>  = ; Data:<br> Version: 3 (0x2= )<br> Serial Number: 2 (0x2)<br>&= nbsp; Signature Algorithm: sha1WithRSAE= ncryption<br> Issuer: C=3DCN, ST= =3DJS, L=3DSZ, O=3DSUDA, OU=3DCSTS,=20 <a href=3D"mailto:CN=3DVPNGW/[email protected]">CN=3DVPN= GW/[email protected]</a><br> &nbs= p; Validity<br> = Not Before: Feb 23 08:24:13 2006 GMT<br> &nbs= p; Not After : Feb 23 08:24= :13 2007 GMT <br> Subject: C=3DCN, ST=3DJS, O= =3DSUDA, OU=3DCSTS, <a href=3D"mailto:CN=3DZXM/emailAddress=3D210313105@sud= a.edu.cn">CN=3DZXM/[email protected]</a><br> = Subject Public Key Info:<br> &nbs= p; Public Key Algorithm: rs= aEncryption <br> RSA = Public Key: (1024 bit)<br> &= nbsp; Modulus (1024 bit):<br> &nbs= p; &= nbsp; 00:d9:f7:c3:6c:8a:64:59:c0:76:5e:9e:06:51:ea:= <br>  = ; 77:2c:c2:f6:6f:f3:73:52:0c:43:d= 0:a3:7f:a3:b8:<br> &nb= sp; 25:c2:9a:6f:9d:f1:8f:f4:13:6f:ec:83= :5e:e5:81:<br> &= nbsp; c0:5b:79:f2:45:78:55:= 38:69:27:e4:e1:62:99:33:<br>  = ; 7d:6e:d= 2:f7:72:98:4c:ae:fb:8e:c8:dd:7b:6b:7b:<br> &nb= sp; = 59:e0:f9:95:e4:5a:f8:5c:8f:b9:f9:6b:1d:80:5a: <br>  = ; 8c:50:43:c3:b7:6a:ae:ff:32:e6:c= c:76:37:6a:a7:<br> &nb= sp; ef:36:ea:77:36:15= :e8:da:6a:6b:e3:0d:42:37:51:<br> &= nbsp; da:= 91:07:28:8b:d1:55:06:07<br> = Exponent: 65537 (0x10001) <br> X509v3 extensions:<br> = X509v3 Subject= Key Identifier: <br> = E4:46:CD:AC:4D:40:ED:2E:7F:A5:0B:81:30:42:9B:13:D1:82:85:D9<br= > X509v3 = Authority Key Identifier: <br> &nb= sp; keyid:B3:2C:63:EA:49:6B:CE:40:CE:5C:48:A1:21:01:22:8C= :9B:53:33:A7 <br> DirN= ame:/C=3DCN/ST=3DJS/L=3DSZ/O=3DSUDA/OU=3DCSTS/CN=3DVPNGW/emailAddress=3D<a = href=3D"mailto:[email protected]">[email protected]</a><br> &n= bsp; serial:00<br>&nb= sp;<br> X= 509v3 Basic Constraints: <br> &nbs= p; CA:TRUE <br> X509= v3 CRL Distribution Points: <br> &= nbsp; URI:<a href=3D"http://210.29.174.137/CA.crl">http:/= /210.29.174.137/CA.crl</a><br> <br> Signature Algori= thm: sha1WithRSAEncryption<br> 56= :7e:cc:47:ac:ff:08:27:41:c9:83:2f:3e:e9:ae:44:77:c7: <br> d6:ea:47:fa:1f:c1:2b:e3:38:8= 5:9a:7c:7c:8a:53:73:83:18:<br> 2c= :59:7f:ed:6d:03:7a:58:3c:b5:5f:2c:bb:85:81:5c:32:55:<br> &= nbsp; d4:48:a4:6b:67:08:fa:a2:6f:e7:b3:55:9c:cf:8c:54:7d:= b7:<br> dc:00:76:69:33:7c:c1:a2:c= b:e7:93:e0:d7:20:ad:56:73:7f: <br> 26:1d:9d:48:49:7e:52:9a:20:4= 6:4b:f7:e9:f7:08:8a:e5:1d:<br> 1f= :02:6b:cc:43:e8:a5:d8:0e:ed:8f:87:26:6c:66:78:88:1e:<br> &= nbsp; 45:3a<br>-----BEGIN CERTIFICATE-----<br>MIIDZzCCAtC= gAwIBAgIBAjANBgkqhkiG9w0BAQUFADB7MQswCQYDVQQGEwJDTjEL <br>MAkGA1UECBMCSlMxCzAJBgNVBAcTAlNaMQ0wCwYDVQQKEwRTVURBMQ0wCwYDVQQL<br>EwR= DU1RTMQ4wDAYDVQQDEwVWUE5HVzEkMCIGCSqGSIb3DQEJARYVcnVubmluZy5k<br>Y3lAZ21haW= wuY29tMB4XDTA2MDIyMzA4MjQxM1oXDTA3MDIyMzA4MjQxM1owbDEL<br>MAkGA1UEBhMCQ04xC= zAJBgNVBAgTAkpTMQ0wCwYDVQQKEwRTVURBMQ0wCwYDVQQL <br>EwRDU1RTMQwwCgYDVQQDEwNaWE0xJDAiBgkqhkiG9w0BCQEWFTIxMDMxMzEwNUBz<br>dWR= hLmVkdS5jbjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA2ffDbIpkWcB2<br>Xp4GUep3LM= L2b/NzUgxD0KN/o7glwppvnfGP9BNv7INe5YHAW3nyRXhVOGkn5OFi<br>mTN9btL3cphMrvuOy= N17a3tZ4PmV5Fr4XI+5+WsdgFqMUEPDt2qu/zLmzHY3aqfv <br>Nup3NhXo2mpr4w1CN1HakQcoi9FVBgcCAwEAAaOCAQgwggEEMB0GA1UdDgQWBBTk<br>Rs2= sTUDtLn+lC4EwQpsT0YKF2TCBpQYDVR0jBIGdMIGagBSzLGPqSWvOQM5cSKEh<br>ASKMm1Mzp6= F/pH0wezELMAkGA1UEBhMCQ04xCzAJBgNVBAgTAkpTMQswCQYDVQQH<br>EwJTWjENMAsGA1UEC= hMEU1VEQTENMAsGA1UECxMEQ1NUUzEOMAwGA1UEAxMFVlBO <br>R1cxJDAiBgkqhkiG9w0BCQEWFXJ1bm5pbmcuZGN5QGdtYWlsLmNvbYIBADAMBgNV<br>HRM= EBTADAQH/MC0GA1UdHwQmMCQwIqAgoB6GHGh0dHA6Ly8yMTAuMjkuMTc0LjEz<br>Ny9DQS5jcm= wwDQYJKoZIhvcNAQEFBQADgYEAVn7MR6z/CCdByYMvPumuRHfH1upH<br>+h/BK+M4hZp8fIpTc= 4MYLFl/7W0Delg8tV8su4WBXDJV1Eika2cI+qJv57NVnM+M <br>VH233AB2aTN8waLL55Pg1yCtVnN/Jh2dSEl+UpogRkv36fcIiuUdHwJrzEPopdgO<br>7Y+= HJmxmeIgeRTo=3D<br>-----END CERTIFICATE-----<br> </div><br> </div= ><br><br clear=3D"all"><br>-- <br>Regards,<br><br>Du Chun-yan<br><a href=3D= "mailto:[email protected]"> [email protected]</a>=20 ------=_Part_2372_24334427.1140705860024-- --------------020302070001020100010605--