<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>Hey folks:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I am having an issue with the Shrew Soft VPN client connecting to my OpenBSD 4.8 isakmpd gateway since attempting a switch from Pre-Shared Key Auth to Mutual RSA Auth using a Windows 2008 R2 Certificate Services CA.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I am using the sscep client to connect to the Windows CA via Network Device Enrollment Service (mscep) to pull the CA certificate and request and pull client certificates to isakmpd on the OpenBSD gateway.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I have installed the Windows CA certificate to /etc/isakmpd/ca/ca.crt and I am able to verify client certificates against it using `openssl verify –Cafile /etc/isakmpd/ca/ca.crt /etc/isakmpd/certs/local.crt` etc…<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I have a local cert and key as well as a client cert and key installed into isakmpd.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Upon attempting a connection via Shrew Soft VPN client, Phase 1 fails with “unable to verify remote peer certificate”.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>On the OpenBSD gateway isakmpd logs:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>…Default isakmpd: phase 1 done: initiator id…<o:p></o:p></p><p class=MsoNormal>…Default isakmpd: Peer <ipaddress> made us delete live SA peer-default for proto 1, initiator id…<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I am assuming Shrew is complaining about my OpenBSD gateway’s issued cert and not the CA cert correct?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Can someone help give me a clue as to what is going on here?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thanks,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>don..<o:p></o:p></p></div></body></html>