  am trying to setup IPSEC connections between two machines using
x.509 certificates  using a CA.

On each machine I created the keys and the certificate like this :
# openssl genrsa -des3 -out west.key 1024
# openssl req -new -key west.key -x509 -out west.cert
I have also generated CSR for and signed them using CA Certificate.

I can view both certificates using
openssl x509 -in certicate-name -text -noout (everything seems to be valid)

ipsec.conf on both machines is similar :
conn temp
     left=....
     right=.....
     leftcert=left.cert
     leftid=%fromcert
     auto=add
     leftca=ca-certificate.pem


The certificates left.cert is placed on left machine and right.cert  
are placed in
/etc/ipsec.d/certs on right machine and each machine has its own
private key at /etc/ipsec.d/private/

ipsec.secrets on both machines is similar (change left to right etc):
: RSA left.key 'passphrase'

The error I am getting on giving ipsec auto --up linux-conn is
INVALID_KEY_INFORMATION.

The openswan wiki quick problem solving guide says :

Problem: INVALID_KEY_INFORMATION
Cause: Openswan did receive a key, but could not establish its
authenticity. With certificates, it might mean that not all CA
certificates in the certificate chain are in /etc/ipsec.d/cacerts.
FIXME(I do not know too much about the other auth methods): with
dnssec, maybe the DNS is unreacheable, or does not contain the
necessary data.


I have also placed ca-certificate.pem in /cacerts in  
/etc/ipsec.d/cacerts directory still
getting same error..


Thanking You,

Tushar Sharma


