Hi Nikos,
thanks for your fast reply.
>> I want to get ocserv with certificates from StartSSL running but it doesn?t work.
>
> What doesn't work?
Sorry, I?ve forgot to said that I can?t connect from my iPhone with latest AnyConnect client the ocserv 0.8.8. If I try I get the following log output:
??
Dec 3 13:29:12 test-vpn ocserv[11426]: main: main-misc.c:754: cannot open: /sys/fs/cgroup/cpuset/test/tasks
Dec 3 13:29:13 test-vpn ocserv[11455]: worker: 178.24.234.134:52671 client certificate verification failed: The certificate is NOT trusted. The certificate issuer is unknown.
Dec 3 13:29:13 test-vpn ocserv[11427]: sec-mod: received request from pid 11455 and uid 65534
Dec 3 13:29:13 test-vpn ocserv[11427]: sec-mod: cmd [size=517] sm: decrypt
Dec 3 13:29:13 test-vpn ocserv[11455]: worker: 178.24.234.134:52671 no certificate provided for authentication
Dec 3 13:29:13 test-vpn ocserv[11426]: main: 178.24.234.134:52671 main-misc.c:425: command socket closed
Dec 3 13:29:13 test-vpn ocserv[11426]: main: main-misc.c:754: cannot open: /sys/fs/cgroup/cpuset/test/tasks
Dec 3 13:29:13 test-vpn ocserv[11456]: worker: 178.24.234.134:52672 client certificate verification failed: The certificate is NOT trusted. The certificate issuer is unknown.
Dec 3 13:29:13 test-vpn ocserv[11427]: sec-mod: received request from pid 11456 and uid 65534
Dec 3 13:29:13 test-vpn ocserv[11427]: sec-mod: cmd [size=517] sm: decrypt
Dec 3 13:29:13 test-vpn ocserv[11456]: worker: 178.24.234.134:52672 no certificate provided for authentication
Dec 3 13:29:13 test-vpn ocserv[11426]: main: 178.24.234.134:52672 main-misc.c:425: command socket closed
Dec 3 13:29:13 test-vpn ocserv[11426]: main: main-misc.c:754: cannot open: /sys/fs/cgroup/cpuset/test/tasks
Dec 3 13:29:13 test-vpn ocserv[11457]: worker: 178.24.234.134:52673 tlslib.c:372: error verifying client certificate: No certificate was found.
Dec 3 13:29:13 test-vpn ocserv[11427]: sec-mod: received request from pid 11457 and uid 65534
Dec 3 13:29:13 test-vpn ocserv[11427]: sec-mod: cmd [size=517] sm: decrypt
Dec 3 13:29:13 test-vpn ocserv[11457]: worker: 178.24.234.134:52673 no certificate provided for authentication
Dec 3 13:29:13 test-vpn ocserv[11426]: main: 178.24.234.134:52673 main-misc.c:425: command socket closed
??
The config file is:
??
auth = "certificate"
max-clients = 16
max-same-clients = 2
tcp-port = 443
udp-port = 443
keepalive = 32400
dpd = 90
mobile-dpd = 1800
try-mtu-discovery = false
server-cert = /etc/ocserv/ssl/server-chain-cert.pem
server-key = /etc/ocserv/ssl/server-key.pem
ca-cert = /etc/ocserv/ssl/ca-sub1-chain-cert.pem
cert-user-oid = 2.5.4.3
cert-group-oid = 2.5.4.11
tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT"
auth-timeout = 40
cookie-timeout = 300
deny-roaming = false
rekey-time = 172800
rekey-method = ssl
use-utmp = true
use-occtl = true
pid-file = /var/run/ocserv.pid
socket-file = /var/run/ocserv-socket
run-as-user = nobody
run-as-group = nogroup
cgroup = "cpuset,cpu:test"
device = vpns
predictable-ips = true
default-domain = example.com
ipv4-network = 192.168.1.0
ipv4-netmask = 255.255.255.0
dns = 8.8.8.8
ping-leases = false
route-add-cmd = "ip route add %{R} dev %{D}"
route-del-cmd = "ip route delete %{R} dev %{D}"
cisco-client-compat = true
??
>
>> The special thing with StartSSL is that they use Sub-CAs for signing server and client certificates. So I?ve a server certificate from sub.class2.server.ca.pem and client certificates from sub.class1.server.ca.pem and sub.class2.server.ca.pem. So what should I do to get ocserv running?
>> I?ve created a server certificate with certificate chain inside (cat server.pem sub.class2.server.ca.pem ca.pem > /etc/ocserv/ssl/server-chain-cert.pem) and the config settings:
>> server-cert = /etc/ocserv/ssl/server-chain-cert.pem
>> server-key = /etc/ocserv/ssl/server-key.pem
>
> Nothing special about it, seems reasonable.
>
>> Then I created a CA chain certificate for all client certificates with sub.class1.server.ca.pem (cat sub.class1.server.ca.pem ca.pem > /etc/ocserv/ssl/ca-sub1-chain-cert.pem).
>> ca-cert = /etc/ocserv/ssl/ca-sub1-chain-cert.pem
>> But now I don?t know how I could enable the login access for individual user with certificate from sub.class1.server.ca.pem?
>
> If you use
> auth = "certificate"
> and ca-cert has the authority that signs certificates, what you
> describe will work.
> However, I am confused from your description. Are
> ca-sub1-chain-cert.pem and sub.class1.server.ca.pem the same thing?
> Why did you use different names?
I don?t know exactly but StartSSL use an intermediate CA certificate to provide certificates for different level of identification. Normally I have to provide all certificates from the chain from server to ca with the sub level of class1 or class2 certificate. But I could test it with only the class1 thing - but what?s with the clients which got a class2 certificate?
And the important question: The client certificate are directly from StartSSL and I don?t own a CA or sub CA - how could I restrict logins to only my users? Should I have to install the client certificate to the server or what should I do?
> In any case the rule is in ca-cert you put the CA to verify the
> clients, and in server-cert, the chain of your server's CA.
regards,
Michael
