I'm using the strongswan documentation right here

I've added to /etc/ipsec.secrets the following line:

: RSA moonKey.pem "SomePwd"

however i don't know how to create moonKey.pem. Any ideas?

this is a follow up question to this one: strongSwan ipsec setup, couple of questions

  • I would appreciate if someone with enough rep could edit the post and add a "strongSwan" tag. thanks! – lurscher Apr 11 '11 at 20:48

If you just want to generate pre-shared keys and not use certificates, then two examples are provided at Linux Kernel 2.6 using KAME-tools using xxd -- "make a hexdump or do the reverse"

$ # Generate 128 Bit long key
$ #
$ dd if=/dev/random count=16 bs=1 | xxd -ps
16+0 Records ein
16+0 Records aus

$ # Generate 192 Bit long key
$ #
$ dd if=/dev/random count=24 bs=1 | xxd -ps
24+0 Records ein
24+0 Records aus

This post on the strongSwan mailing list seems to cover your question.


openssl req -x509 -days 1460 -newkey rsa:1024 -keyout moonKey.pem -out mooncert.pem -subj "/CN=moon/" -nodes
  • Note: they don't tell you this in the guide because they assume (based on text here ) that you know this: "Also, we consider that you know how to use and generate SSH public and private key pairs and that you know how to connect remotely to a host using SSH." – entropo Apr 11 '11 at 22:51
  • thats for creating moonCert.pem. moonKey.pem is supposedly the shared secret file between the hosts – lurscher Apr 11 '11 at 22:52
  • so according to this scheme, at what point is used the shared secret? i don't see in the documentation any mention of copy the same file on the sun and moon gateways – lurscher Apr 11 '11 at 22:58

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.