2

I have two systems r1 and r2, and I want to establish an ESP tunnel between them with Strongswan using public key authentication. I have generated public keys, store in r1-pub.pem and r2-pub.pem respectively, in both the systems using openssl.

Now my ipsec.conf file looks like this in system r1

conn host-host-rsa

left=1.1.1.1
leftsubnet=192.168.10.0/24
[email protected]
leftauth=pubkey
leftrsasigkey=/root/r1-pub.pem
right=2.2.2.2
rightsubnet=192.168.20.0/24
[email protected]
rightauth=pubkey
rightrsasigkey=/root/r2-pub.pem
type=tunnel
auto=add

and in system r2, the configuration is

conn host-host-rsa
left=2.2.2.2
leftsubnet=192.168.20.0/24
[email protected]
leftauth=pubkey
leftrsasigkey=/root/r2-pub.pem
right=1.1.1.1
rightsubnet=192.168.10.0/24
[email protected]
rightauth=pubkey
rightrsasigkey=/root/r1-pub.pem
type=tunnel
auto=add

Now when starting ipsec on r1, I am getting this error

Starting strongSwan 5.1.2 IPsec [starter]...
00[DMN] Starting IKE charon daemon (strongSwan 5.1.2, Linux 3.13.0-32-generic, x86_64)
00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'
00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'
00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'
00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'
00[CFG] loading crls from '/etc/ipsec.d/crls'
00[CFG] loading secrets from '/etc/ipsec.secrets'
00[LIB] loaded plugins: charon test-vectors aes rc2 sha1 sha2 md4 md5 random nonce x509 revocation constraints pkcs1 pkcs7 pkcs8 pkcs12 pem openssl xcbc cmac hmac ctr ccm gcm attr kernel-netlink resolve socket-default stroke updown eap-identity addrblock
00[LIB] unable to load 5 plugin features (5 due to unmet dependencies)
00[LIB] dropped capabilities, running as uid 0, gid 0
00[JOB] spawning 16 worker threads
charon (607) started after 300 ms
04[CFG] received stroke: add connection 'host-host-rsa'
04[LIB] building CRED_CERTIFICATE - TRUSTED_PUBKEY failed, tried 0 builders
04[CFG]   loading public key for "moon.strongswan.org" from '/root/r1-pub.pem' failed
04[LIB] building CRED_CERTIFICATE - TRUSTED_PUBKEY failed, tried 0 builders
04[CFG]   loading public key for "sun.strongswan.org" from '/root/r2-pub.pem' failed
04[CFG] added configuration 'host-host-rsa'

I don't know why this loading public key error is happening. Any help will be appreciated.

1 Answer 1

2

You need the pubkey plugin to use raw public keys. If you specified charon.load in strongswan.conf make sure to include that plugin in the list. If you haven't then you either didn't build the plugin or your distribution does not ship it. In both cases you'll have to rebuild strongSwan from sources with the appropriate ./configure options.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .