PRE-TEST moon# ipsec start Starting strongSwan 4.3.6 IPsec [starter]... carol# ipsec start Starting strongSwan 4.3.6 IPsec [starter]... carol# sleep 2 carol# ipsec up home initiating IKE_SA home[1] to 192.168.0.1 generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ] sending packet: from 192.168.0.100[500] to 192.168.0.1[500] received packet: from 192.168.0.1[500] to 192.168.0.100[500] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(MULT_AUTH) ] received cert request for "C=CH, O=Linux strongSwan, CN=strongSwan Root CA" sending cert request for "C=CH, O=Linux strongSwan, CN=strongSwan Root CA" authentication of 'carol@strongswan.org' (myself) with RSA signature successful sending end entity cert "C=CH, O=Linux strongSwan, OU=Research, CN=carol@strongswan.org" establishing CHILD_SA home generating IKE_AUTH request 1 [ IDi CERT CERTREQ IDr AUTH SA TSi TSr N(MOBIKE_SUP) N(ADD_6_ADDR) N(MULT_AUTH) N(EAP_ONLY) ] sending packet: from 192.168.0.100[4500] to 192.168.0.1[4500] received packet: from 192.168.0.1[4500] to 192.168.0.100[4500] parsed IKE_AUTH response 1 [ N(AUTH_FAILED) ] received AUTHENTICATION_FAILED notify error TEST moon# cat /var/log/daemon.log | grep 'requesting ocsp status from' [YES] Feb 28 00:37:11 moon charon: 15[CFG] requesting ocsp status from 'http://ocsp.strongswan.org:8880' ... moon# cat /var/log/daemon.log | grep 'ocsp response correctly signed by' [YES] Feb 28 00:37:11 moon charon: 15[CFG] ocsp response correctly signed by "C=CH, O=Linux strongSwan, OU=OCSP Signing Authority, CN=ocsp.strongswan.org" moon# cat /var/log/daemon.log | grep 'certificate was revoked on' [YES] Feb 28 00:37:11 moon charon: 15[CFG] certificate was revoked on Aug 27 10:34:05 UTC 2009, reason: key compromise moon# cat /var/log/daemon.log | grep 'authentication of.*carol@strongswan.org.*with RSA signature failed' [] carol# cat /var/log/daemon.log | grep 'received AUTHENTICATION_FAILED notify error' [YES] Feb 28 00:37:11 carol charon: 02[IKE] received AUTHENTICATION_FAILED notify error moon# ipsec status | grep 'rw.*ESTABLISHED' [NO] carol# ipsec status | grep 'home.*ESTABLISHED' [NO] POST-TEST moon# ipsec stop Stopping strongSwan IPsec... carol# ipsec stop Stopping strongSwan IPsec... carol# rm /etc/ipsec.d/private/* carol# rm /etc/ipsec.d/certs/*