<html><body><div style="color:#000; background-color:#fff; font-family:verdana, helvetica, sans-serif;font-size:10pt"><div style="font-family: verdana, helvetica, sans-serif; font-size: 10pt; ">Hello,</div><div style="font-family: verdana, helvetica, sans-serif; font-size: 10pt; "><br></div><div style="font-family: verdana, helvetica, sans-serif; font-size: 10pt; "><span style="font-size: 10pt; ">I followed the example described in README.nss to setup ipsec </span><span>with certs in tunnel mode using NSS. </span></div><div style="font-family: verdana, helvetica, sans-serif; font-size: 10pt; "><span>However, I got the following error messages captured at machine 1. Looks like validating the peer (i.e.g, machine 2) certificates at machine 1 failed.<br></span></div><div style="font-family: verdana, helvetica, sans-serif; font-size: 10pt; "><span><br></span></div><div style="font-family: verdana, helvetica, sans-serif; font-size: 10pt;
"><span>----------------------------------------------------------------------------------------------------------------</span></div><div style="font-family: verdana, helvetica, sans-serif; font-size: 10pt; "><span style="font-size: 10pt; ">Apr 11 16:17:54 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #134: NSS: failure in verifying signature</span><br></div><div><div style="font-family: 'Times New Roman'; font-size: medium; "><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:17:54 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #134: invalid certificate signature from "CN=cacert1" on "CN=usercert2"</font></div><div style="font-family: 'Times New Roman'; font-size: medium; "><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:17:54 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #134: X.509 certificate rejected</font></div><div style="font-family: 'Times New Roman'; font-size: 16px; "><font face="verdana, helvetica,
sans-serif" size="2">Apr 11 16:17:54 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #134: no suitable connection for peer 'CN=usercert2'</font></div><div style="font-family: 'Times New Roman'; font-size: 16px; "><font face="verdana, helvetica, sans-serif" size="2"><span style="font-size: 13px; ">----------------------------------------------------------------------------------------------------------------</span> <br></font></div><div style="font-family: 'Times New Roman'; font-size: 16px; "><span style="font-family: verdana, helvetica, sans-serif; font-size: 13px; "><br></span></div><div style="font-family: 'Times New Roman'; font-size: 16px; "><span style="font-family: verdana, helvetica, sans-serif; font-size: 13px; ">I took the exact same steps shown in README.nss, which is also attached below. What is missing here in README.nss? </span><span style="font-family: verdana, helvetica, sans-serif; font-size: 13px;
"> </span><br></div><div style="font-family: 'Times New Roman'; font-size: 16px; "><span style="font-family: verdana, helvetica, sans-serif; font-size: 13px; ">Can you please give me a light on how to make it work? M</span><span style="font-family: verdana, helvetica, sans-serif; font-size: 13px; ">ore e</span><span style="font-family: verdana, helvetica, sans-serif; font-size: 13px; ">rror messages captured at machine 1</span><span style="font-family: verdana, helvetica, sans-serif; font-size: 13px; "> is attached below.</span><span style="font-family: verdana, helvetica, sans-serif; font-size: 13px; "> </span><span style="font-family: verdana, helvetica, sans-serif; font-size: 13px; "> </span></div><div style="font-family: 'Times New Roman'; font-size: 16px; "><span style="font-family: verdana, helvetica, sans-serif; font-size: 13px; "><br></span></div><div style="font-family: 'Times New Roman'; font-size: 16px; "><span
style="font-family: verdana, helvetica, sans-serif; font-size: 13px; ">Thank you in advance.</span></div><div style="font-family: 'Times New Roman'; font-size: 16px; "><span style="font-family: verdana, helvetica, sans-serif; font-size: 13px; ">BJ</span></div><div style="font-family: 'Times New Roman'; font-size: 16px; "><span style="font-family: verdana, helvetica, sans-serif; font-size: 13px; "><br></span></div><div style="font-family: 'Times New Roman'; font-size: 16px; "><span style="font-family: verdana, helvetica, sans-serif; font-size: 13px; ">P.S. I checked the validation of certificates at machines 1 and 2. All of them are valid, as shown below:</span></div><div style="font-family: 'Times New Roman'; font-size: 16px; "><span style="font-family: verdana, helvetica, sans-serif; font-size: 13px; "><br></span></div><div><font face="verdana, helvetica, sans-serif" size="2">-------------</font></div><div><font face="verdana, helvetica, sans-serif"
size="2">machine1</font></div><div style="font-family: 'Times New Roman'; font-size: 16px; "><span style="font-family: verdana, helvetica, sans-serif; font-size: 13px; ">-------------</span></div><div><span><div><font face="verdana, helvetica, sans-serif" size="2">[root@rhel-5-1-32-server-ws55 ~]# certutil -L -d /etc/ipsec.d</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Certificate Nickname Trust Attributes</font></div><div><font face="verdana, helvetica, sans-serif" size="2"> SSL,S/MIME,JAR/XPI</font></div><div><font face="verdana, helvetica, sans-serif" size="2">cacert1
Cu,Cu,Cu</font></div><div><font face="verdana, helvetica, sans-serif" size="2">usercert1 u,u,u</font></div><div><font face="verdana, helvetica, sans-serif" size="2">[root@rhel-5-1-32-server-ws55 ~]# </font></div><div><font face="verdana, helvetica, sans-serif" size="2"><div>[root@rhel-5-1-32-server-ws55 ~]# certutil -K -d /etc/ipsec.d</div><div>certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services "</div><div>< 0> rsa 1029af12cdb13ef4f1aebd21ee796b6c0ad4c30a
NSS Certificate DB:cacert1</div><div>< 1> rsa 677dbe4d5465b7abf4b73252678916f96bf810ae NSS Certificate DB:usercert1</div><div>[root@rhel-5-1-32-server-ws55 ~]# </div></font></div><div><div><font face="verdana, helvetica, sans-serif" size="2">[root@rhel-5-1-32-server-ws55 ~]# certutil -V -n cacert1 -u CVS -e -l -d /etc/ipsec.d</font></div><div><font face="verdana, helvetica, sans-serif" size="2">certutil: certificate is valid</font></div><div><font face="verdana, helvetica, sans-serif" size="2">[root@rhel-5-1-32-server-ws55 ~]# certutil -V -n usercert1 -u CVS -e -l -d /etc/ipsec.d</font></div><div><font face="verdana, helvetica, sans-serif" size="2">certutil: certificate is valid</font></div><div><font face="verdana, helvetica, sans-serif" size="2">[root@rhel-5-1-32-server-ws55 ~]# </font></div><div style="font-family: verdana, helvetica, sans-serif; font-size: 13px; "><br></div></div></span></div><div
style="font-family: 'Times New Roman'; font-size: 16px; "><span style="font-family: verdana, helvetica, sans-serif; font-size: 13px; "><br></span></div><div style="font-family: 'Times New Roman'; font-size: 16px; "><span style="font-family: verdana, helvetica, sans-serif; font-size: 13px; "><div style="font-family: 'Times New Roman'; font-size: medium; "><font face="verdana, helvetica, sans-serif" size="2">-------------</font></div><div style="font-family: 'Times New Roman'; font-size: 16px; "><font face="verdana, helvetica, sans-serif" size="2">machine2</font></div><div style="font-family: 'Times New Roman'; font-size: 16px; "><span style="font-family: verdana, helvetica, sans-serif; font-size: 13px; ">-------------</span></div></span></div><div><font face="verdana, helvetica, sans-serif" size="2"><div>[root@rhel-5-1-32-server-ws55 ~]# certutil -L -d /etc/ipsec.d</div><div>Certificate Nickname
Trust Attributes</div><div> SSL,S/MIME,JAR/XPI</div><div><br></div><div>cacert1 Cu,Cu,Cu</div><div>usercert2 u,u,u</div><div>[root@rhel-5-1-32-server-ws55 ~]# certutil -K -d /etc/ipsec.d</div><div>certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services
"</div><div>< 0> rsa 1029af12cdb13ef4f1aebd21ee796b6c0ad4c30a cacert1</div><div>< 1> rsa 3f9e69e1601d90db6d86d474bbba62361ccc12ee NSS Certificate DB:usercert2</div><div>[root@rhel-5-1-32-server-ws55 ~]# certutil -V -n cacert1 -u CVS -e -l -d /etc/ipsec.d</div><div>certutil: certificate is valid</div><div>[root@rhel-5-1-32-server-ws55 ~]# certutil -V -n usercert2 -u CVS -e -l -d /etc/ipsec.d</div><div>certutil: certificate is valid</div><div>[root@rhel-5-1-32-server-ws55 ~]#</div></font></div><div><font face="verdana, helvetica, sans-serif" size="2"><br></font></div><div style="font-family: 'Times New Roman'; font-size: 16px; "><font face="verdana, helvetica, sans-serif" size="2">==========</font></div><div><font face="verdana, helvetica, sans-serif" size="2">README.nss<br></font></div><div style="font-family: 'Times New Roman';
font-size: 16px; "><font face="verdana, helvetica, sans-serif" size="2">==========</font></div></div><div style="font-family: verdana, helvetica, sans-serif; font-size: 10pt; "><br></div><div><div><font face="verdana, helvetica, sans-serif" size="2">An example Scenario: To setup ipsec with certs in tunnel mode using NSS</font></div><div><font face="verdana, helvetica, sans-serif" size="2">------------------------------------------------------------</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><br></font></div><div><font face="verdana, helvetica, sans-serif" size="2">GW Machine 1: w1.x1.y1.z1 </font></div><div><font face="verdana, helvetica, sans-serif" size="2">GW Machine 2: w2.x2.y2.z2 </font></div><div><font face="verdana, helvetica, sans-serif" size="2"><br></font></div><div><font face="verdana, helvetica, sans-serif" size="2">w1.x1.y1.z1 <---> w2.x2.y2.z2</font></div><div><font face="verdana, helvetica,
sans-serif" size="2"><br></font></div><div><font face="verdana, helvetica, sans-serif" size="2">Note: In this example setup, both machines are using NSS. If you want to use</font></div><div><font face="verdana, helvetica, sans-serif" size="2">NSS only at one machine, say machine 1, you can use the following procedure</font></div><div><font face="verdana, helvetica, sans-serif" size="2">only at machine 1, and you can use traditional ipsec setup at machine 2.</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><br></font></div><div><font face="verdana, helvetica, sans-serif" size="2">1. Create a new (if not already) nss db on both machines as follows:</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><br></font></div><div><font face="verdana, helvetica, sans-serif" size="2">certutil -N -d <path-to-ipsec.d dir>/ipsec.d</font></div><div><font face="verdana, helvetica, sans-serif"
size="2"><br></font></div><div><font face="verdana, helvetica, sans-serif" size="2">2. Creating CA certs at both machines:</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><br></font></div><div><font face="verdana, helvetica, sans-serif" size="2">On machine 1:</font></div><div><font face="verdana, helvetica, sans-serif" size="2">certutil -S -k rsa -n cacert1 -s "CN=cacert1" -v 12 -d . -t "C,C,C" -x -d \</font></div><div><font face="verdana, helvetica, sans-serif" size="2"> <path-to-ipsec.d dir>/ipsec.d</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><br></font></div><div><font face="verdana, helvetica, sans-serif" size="2">As we want to use the same certificate "cacert1" at machine 2, it needs to be</font></div><div><font face="verdana, helvetica, sans-serif" size="2">exported first. To export the cacert1, do the following at machine 1:</font></div><div><font face="verdana, helvetica,
sans-serif" size="2"><br></font></div><div><font face="verdana, helvetica, sans-serif" size="2">pk12util -o cacert1.p12 -n cacert1 -d /etc/ipsec.d</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><br></font></div><div><font face="verdana, helvetica, sans-serif" size="2">Copy the file "cacert1.p12" to the machine2 in "/etc/ipsec.d" directory.</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><br></font></div><div><font face="verdana, helvetica, sans-serif" size="2">On machine 2:</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Import the "cacert1" as follows:</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><br></font></div><div><font face="verdana, helvetica, sans-serif" size="2">cd /etc/ipsec.d</font></div><div><font face="verdana, helvetica, sans-serif" size="2">pk12util -i cacert1.p12 -d /etc/ipsec.d</font></div><div><font face="verdana, helvetica, sans-serif"
size="2">certutil -M -n cacert1 -t "C,C,C" -d /etc/ipsec.d</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><br></font></div><div><font face="verdana, helvetica, sans-serif" size="2">Now machine 2 also has the CA certificates "cacert1" in its NSS database.</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><br></font></div><div><font face="verdana, helvetica, sans-serif" size="2">3. Creating user certs at both machines:</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><br></font></div><div><font face="verdana, helvetica, sans-serif" size="2">On machine 1:</font></div><div><font face="verdana, helvetica, sans-serif" size="2">certutil -S -k rsa -c cacert1 -n usercert1 -s "CN=usercert1" -v 12 -t "u,u,u" \</font></div><div><font face="verdana, helvetica, sans-serif" size="2"> -d /etc/ipsec.d</font></div><div><font face="verdana, helvetica, sans-serif" size="2">(Note this cert is signed by
"cacert1")</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><br></font></div><div><font face="verdana, helvetica, sans-serif" size="2">On machine 2:</font></div><div><font face="verdana, helvetica, sans-serif" size="2">certutil -S -k rsa -c cacert1 -n usercert2 -s "CN=usercert2" -v 12 -t "u,u,u" \</font></div><div><font face="verdana, helvetica, sans-serif" size="2"> -d /etc/ipsec.d</font></div><div><font face="verdana, helvetica, sans-serif" size="2">(Note this cert is signed by "cacert1" too)</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><br></font></div><div><font face="verdana, helvetica, sans-serif" size="2">4. Preparing ipsec.conf at both machines</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><br></font></div><div><font face="verdana, helvetica, sans-serif" size="2">ipsec.conf at machine 1:</font></div><div><font face="verdana, helvetica, sans-serif"
size="2"><br></font></div><div><font face="verdana, helvetica, sans-serif" size="2"><br></font></div><div><font face="verdana, helvetica, sans-serif" size="2">conn pluto-1-2</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>left=w1.x1.y1.z1</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>leftid="CN=usercert1"</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>leftsourceip=w1.x1.y1.z1</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>leftrsasigkey=%cert</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>leftcert=usercert1</font></div><div><font
face="verdana, helvetica, sans-serif" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>leftnexthop=w2.x2.y2.z2</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>right=w2.x2.y2.z2</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>rightid="CN=usercert2"</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>rightsourceip=w2.x2.y2.z2</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>rightrsasigkey=%cert</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>rightnexthop=w1.x1.y1.z1</font></div><div><font face="verdana, helvetica, sans-serif"
size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>rekey=no</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>esp="aes-sha1"</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>ike="aes-sha1"</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>auto=add</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><br></font></div><div><font face="verdana, helvetica, sans-serif" size="2"><br></font></div><div><font face="verdana, helvetica, sans-serif" size="2">ipsec.conf at machine 2:</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><br></font></div><div><font face="verdana, helvetica, sans-serif" size="2"><br></font></div><div><font face="verdana, helvetica, sans-serif"
size="2">conn pluto-1-2</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>left=w2.x2.y2.z2</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>leftid="CN=usercert2"</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>leftsourceip=w2.x2.y2.z2</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>leftrsasigkey=%cert</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>leftcert=usercert2</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>leftnexthop=w1.x1.y1.z1</font></div><div><font
face="verdana, helvetica, sans-serif" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>right=w1.x1.y1.z1</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>rightid="CN=usercert1"</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>rightsourceip=w1.x1.y1.z1</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>rightrsasigkey=%cert</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>rightnexthop=w2.x2.y2.z2</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>rekey=no</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><span
class="Apple-tab-span" style="white-space:pre"> </span>esp="aes-sha1"</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>ike="aes-sha1"</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>auto=add</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><br></font></div><div><font face="verdana, helvetica, sans-serif" size="2">5. Preparing ipsec.secrets at both machines </font></div><div><font face="verdana, helvetica, sans-serif" size="2"><br></font></div><div><font face="verdana, helvetica, sans-serif" size="2">ipsec.secrets at machine 1:</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><br></font></div><div><font face="verdana, helvetica, sans-serif" size="2"> : RSA usercert1</font></div><div><font face="verdana, helvetica, sans-serif"
size="2"><br></font></div><div><font face="verdana, helvetica, sans-serif" size="2"><br></font></div><div><font face="verdana, helvetica, sans-serif" size="2">ipsec.secrets at machine 1:</font></div><div><font face="verdana, helvetica, sans-serif" size="2"><br></font></div><div><font face="verdana, helvetica, sans-serif" size="2"> : RSA usercert2</font></div><div style="font-family: verdana, helvetica, sans-serif; font-size: 10pt; "><br></div></div><div style="font-family: verdana, helvetica, sans-serif; font-size: 10pt; "><br></div><div style="font-family: verdana, helvetica, sans-serif; font-size: 10pt; "><br></div><div style="font-family: verdana, helvetica, sans-serif; font-size: 10pt; ">=============================</div><div style="font-family: verdana, helvetica, sans-serif; font-size: 10pt; ">Error messages captured at machine 1</div><div style="font-family: verdana, helvetica, sans-serif; font-size: 10pt;
">=============================</div><div style="font-family: verdana, helvetica, sans-serif; font-size: 10pt; "><br></div><div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:17:44 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #134: Main mode peer ID is ID_DER_ASN1_DN: 'CN=usercert2'</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:17:44 rhel-5-1-32-server-ws55 pluto[28113]: | NSS : RSA Signature NOT verified</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:17:44 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #134: NSS: failure in verifying signature</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:17:44 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #134: invalid certificate signature from "CN=cacert1" on "CN=usercert2"</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:17:44
rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #134: X.509 certificate rejected</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:17:44 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #134: no suitable connection for peer 'CN=usercert2'</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:17:44 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #134: sending encrypted notification INVALID_ID_INFORMATION to 10.20.114.238:500</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:17:54 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #134: Main mode peer ID is ID_DER_ASN1_DN: 'CN=usercert2'</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:17:54 rhel-5-1-32-server-ws55 pluto[28113]: | NSS : RSA Signature NOT verified</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:17:54 rhel-5-1-32-server-ws55 pluto[28113]:
"pluto-1-2" #134: NSS: failure in verifying signature</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:17:54 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #134: invalid certificate signature from "CN=cacert1" on "CN=usercert2"</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:17:54 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #134: X.509 certificate rejected</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:17:54 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #134: no suitable connection for peer 'CN=usercert2'</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:17:54 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #134: sending encrypted notification INVALID_ID_INFORMATION to 10.20.114.238:500</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:18:14 rhel-5-1-32-server-ws55 pluto[28113]:
"pluto-1-2" #134: Main mode peer ID is ID_DER_ASN1_DN: 'CN=usercert2'</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:18:14 rhel-5-1-32-server-ws55 pluto[28113]: | NSS : RSA Signature NOT verified</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:18:14 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #134: NSS: failure in verifying signature</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:18:14 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #134: invalid certificate signature from "CN=cacert1" on "CN=usercert2"</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:18:14 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #134: X.509 certificate rejected</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:18:14 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #134: no suitable connection for peer
'CN=usercert2'</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:18:14 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #134: sending encrypted notification INVALID_ID_INFORMATION to 10.20.114.238:500</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:18:54 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #134: max number of retransmissions (2) reached STATE_MAIN_R2</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:18:54 rhel-5-1-32-server-ws55 pluto[28113]: packet from 10.20.114.238:500: received Vendor ID payload [Openswan (this version) 2.6.21 ]</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:18:54 rhel-5-1-32-server-ws55 pluto[28113]: packet from 10.20.114.238:500: received Vendor ID payload [Dead Peer Detection]</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:18:54 rhel-5-1-32-server-ws55
pluto[28113]: "pluto-1-2" #135: responding to Main Mode</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:18:54 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #135: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:18:54 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #135: STATE_MAIN_R1: sent MR1, expecting MI2</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:18:54 rhel-5-1-32-server-ws55 pluto[28113]: pluto_do_crypto: helper (0) is exiting</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:18:54 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #135: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:18:54 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #135: STATE_MAIN_R2:
sent MR2, expecting MI3</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:18:54 rhel-5-1-32-server-ws55 pluto[28113]: pluto_do_crypto: helper (0) is exiting</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:18:54 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #135: Main mode peer ID is ID_DER_ASN1_DN: 'CN=usercert2'</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:18:54 rhel-5-1-32-server-ws55 pluto[28113]: | NSS : RSA Signature NOT verified</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:18:54 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #135: NSS: failure in verifying signature</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:18:54 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #135: invalid certificate signature from "CN=cacert1" on "CN=usercert2"</font></div><div><font
face="verdana, helvetica, sans-serif" size="2">Apr 11 16:18:54 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #135: X.509 certificate rejected</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:18:54 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #135: no suitable connection for peer 'CN=usercert2'</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:18:54 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #135: sending encrypted notification INVALID_ID_INFORMATION to 10.20.114.238:500</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:19:04 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #135: Main mode peer ID is ID_DER_ASN1_DN: 'CN=usercert2'</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:19:04 rhel-5-1-32-server-ws55 pluto[28113]: | NSS : RSA Signature NOT verified</font></div><div><font face="verdana, helvetica, sans-serif"
size="2">Apr 11 16:19:04 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #135: NSS: failure in verifying signature</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:19:04 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #135: invalid certificate signature from "CN=cacert1" on "CN=usercert2"</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:19:04 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #135: X.509 certificate rejected</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:19:04 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #135: no suitable connection for peer 'CN=usercert2'</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:19:04 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #135: sending encrypted notification INVALID_ID_INFORMATION to 10.20.114.238:500</font></div><div><font face="verdana, helvetica, sans-serif"
size="2">Apr 11 16:19:24 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #135: Main mode peer ID is ID_DER_ASN1_DN: 'CN=usercert2'</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:19:24 rhel-5-1-32-server-ws55 pluto[28113]: | NSS : RSA Signature NOT verified</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:19:24 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #135: NSS: failure in verifying signature</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:19:24 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #135: invalid certificate signature from "CN=cacert1" on "CN=usercert2"</font></div><div><font face="verdana, helvetica, sans-serif" size="2">Apr 11 16:19:24 rhel-5-1-32-server-ws55 pluto[28113]: "pluto-1-2" #135: X.509 certificate rejected</font></div><div style="font-family: verdana, helvetica, sans-serif; font-size: 10pt;
"><br></div></div></div></body></html>