Ipsec Rsasigkey: Key Pair Generation Failed: -8187
Ipsec Rsasigkey: Key Pair Generation Failed: -8187 3,9/5 6049 reviews
This is starting to piss me off. I´ve trying now for a long time to implement a VPN between two sites using OpenSwan and CentOS and I just can´t make it work. In the past I remember being so easy using Debian
Here´s the setup: two offices remotely connected, running same CentOS version
First problem was the absence of the RSA key. Not a problem, let´s create it:
# ipsec newhostkey --output /etc/ipsec.d/hostkeys.secrets --bits 2048
ipsec rsasigkey: configdir is required
Kay, that´s a new one. Fine, done some search and found a configdb at /etc/pki/nssdb/. Again:
# ipsec newhostkey --configdir /etc/pki/nssdb/ --output /etc/ipsec.d/hostkeys.secrets --bits 2048
After a loooooong time, it was ready. Okay, now let´s just create ipsec.conf, as always. Keys were copied from the output of ipsec showhostkey --left/right
# cat /etc/ipsec.conf
version 2.0
config setup
plutodebug='control parsing'
plutostderrlog=/var/log/ipsec.log
protostack=netkey
nat_traversal=no
virtual_private=
oe=off
conn <myConn>
left=X.X.X.X
leftsubnet=Y.Y.Y.Y/YY
leftnexthop=Z.Z.Z.Z
leftrsasigkey=sdniuaheiua..
right=A.A.A.A
rightsubnet=B.B.B.B/BB
rightnexthop=C.C.C.C
rightrsasigkey=msnaibaiufb..
auto=start
The file is the exactly the same at both ends and I´M 100% SURE THE KEYS WERE COPIED CORRECTLY. The thing is:
# service ipsec start
# tail -f /var/log/ipsec.conf
ipsec_setup: Starting Openswan IPsec U2.6.32/K2.6.32-220.7.1.el6.x86_64..
ipsec_setup: multiple ip addresses, using X.X.X.X on eth1
..
And then I start getting a huge amount of:
'myConn' #11: Signature check (on A.A.A.A) failed (wrong key?); tried *AQPbuQvlQ
public key for A.A.A.A failed: decrypted SIG payload into a malformed ECB (3NSS error: Not able to decrypt)
'myConn' #11: sending encrypted notification INVALID_KEY_INFORMATION to A.A.A.A:500
..
And the thing goes into a loop.
1) I´ve already lost count of how many times I did recreate those keys
2) I´ve already n_checked for typos and I can guarantee the keys are correct
I tried recreating them by following this link (going back to basics): http://www.linuxhomenetworking.com/w..enswan_Started
# ipsec rsasigkey --verbose 2048 > keys.tmp
(once again the error about configdir.. okay)
# ipsec --configdir /etc/pki/nssdb rsasigkey --verbose 2048 > keys.tmp
Again, after a long time, I get a new error: 'ipsec rsasigkey: key pair generation failed: '-8037'
I followed till this link (https://lists.openswan.org/pipermail..er/017845.html), installed nss-tools and tried the commands as they were:
# certutil -N -d /etc/ipsec.d (typed in a password when prompted)
# ipsec newhostkey --configdir /etc/ipsec.d --output /etc/ipsec.d/hostkeys.secrets --bits 2048 --password <password_ive_typed>
Again, after a long time it ended, but when I checked the new keys with ipsec showhostkey, I got this:
premature end of RSA key
Which seemed reasonable, since one box had a 2 line key and the other had 3.
As expected, those keys didn´t work (same error about INVALID_KEY)
Tried with a smaller, 1024 bit key. I didn´t get the error on premature end, but the INVALID_KEY messages still persist.
I just don´t know what to do anymore. Anyway I can try to solve this without having to change distributions?
Here´s the setup: two offices remotely connected, running same CentOS version
First problem was the absence of the RSA key. Not a problem, let´s create it:
# ipsec newhostkey --output /etc/ipsec.d/hostkeys.secrets --bits 2048
ipsec rsasigkey: configdir is required
Kay, that´s a new one. Fine, done some search and found a configdb at /etc/pki/nssdb/. Again:
# ipsec newhostkey --configdir /etc/pki/nssdb/ --output /etc/ipsec.d/hostkeys.secrets --bits 2048
After a loooooong time, it was ready. Okay, now let´s just create ipsec.conf, as always. Keys were copied from the output of ipsec showhostkey --left/right
# cat /etc/ipsec.conf
version 2.0
config setup
plutodebug='control parsing'
plutostderrlog=/var/log/ipsec.log
protostack=netkey
nat_traversal=no
virtual_private=
oe=off
conn <myConn>
left=X.X.X.X
leftsubnet=Y.Y.Y.Y/YY
leftnexthop=Z.Z.Z.Z
leftrsasigkey=sdniuaheiua..
right=A.A.A.A
rightsubnet=B.B.B.B/BB
rightnexthop=C.C.C.C
rightrsasigkey=msnaibaiufb..
auto=start
The file is the exactly the same at both ends and I´M 100% SURE THE KEYS WERE COPIED CORRECTLY. The thing is:
# service ipsec start
# tail -f /var/log/ipsec.conf
ipsec_setup: Starting Openswan IPsec U2.6.32/K2.6.32-220.7.1.el6.x86_64..
ipsec_setup: multiple ip addresses, using X.X.X.X on eth1
..
And then I start getting a huge amount of:
'myConn' #11: Signature check (on A.A.A.A) failed (wrong key?); tried *AQPbuQvlQ
public key for A.A.A.A failed: decrypted SIG payload into a malformed ECB (3NSS error: Not able to decrypt)
'myConn' #11: sending encrypted notification INVALID_KEY_INFORMATION to A.A.A.A:500
..
And the thing goes into a loop.
1) I´ve already lost count of how many times I did recreate those keys
2) I´ve already n_checked for typos and I can guarantee the keys are correct
I tried recreating them by following this link (going back to basics): http://www.linuxhomenetworking.com/w..enswan_Started
# ipsec rsasigkey --verbose 2048 > keys.tmp
(once again the error about configdir.. okay)
# ipsec --configdir /etc/pki/nssdb rsasigkey --verbose 2048 > keys.tmp
Again, after a long time, I get a new error: 'ipsec rsasigkey: key pair generation failed: '-8037'
I followed till this link (https://lists.openswan.org/pipermail..er/017845.html), installed nss-tools and tried the commands as they were:
# certutil -N -d /etc/ipsec.d (typed in a password when prompted)
# ipsec newhostkey --configdir /etc/ipsec.d --output /etc/ipsec.d/hostkeys.secrets --bits 2048 --password <password_ive_typed>
Again, after a long time it ended, but when I checked the new keys with ipsec showhostkey, I got this:
premature end of RSA key
Which seemed reasonable, since one box had a 2 line key and the other had 3.
As expected, those keys didn´t work (same error about INVALID_KEY)
Tried with a smaller, 1024 bit key. I didn´t get the error on premature end, but the INVALID_KEY messages still persist.
I just don´t know what to do anymore. Anyway I can try to solve this without having to change distributions?
- Ipsec Rsasigkey: Key Pair Generation Failed: -8187 1
- Ipsec Rsasigkey: Key Pair Generation Failed: -8187 Download
I run Ubuntu 9.10 locally connecting to CentOS5 on a remote server.When I run the following command in the Terminal;ssh -v -L 10005:localhost:10000 root@remoteipaddress -F /.sshconfig -i /.ssh/privatekeyfilenameafter 'Authentication succeeded (publickey)' I get the following for channel 1;systunopen: failed to open tunnel control. Diablo 3 game key generator. A value of of 0 disables replay protection. Disabling of replay protection is sometimes used on a pair of IPsec servers in a High Availability setup, or on servers with very unpredictable latency, such as mobile networks, which can cause an excessive amount of out of order packets.
Ipsec Rsasigkey: Key Pair Generation Failed: -8187 1
- Brand Management Campaign Management Digital Asset Management Email Marketing Lead Generation Marketing Automation SEO Digital Signage.
- Public-key encryption provides better authentication techniques, hence the reason for using a combination of both. Public Key Infrastructure, PKI, is a system to verify and authenticate the validity of each party involved in an Internet transaction. PKI is an asymmetric key system that consists of a pair of keys consisting of a public key and a.
Ipsec Rsasigkey: Key Pair Generation Failed: -8187 Download
CentOS Version 6.1 Man Pages Online. Use Ctrl+F for better performance, use following search bar for better match. And chrome browser is recommened for better search performance. Note that listings are in chronological order of release times, not in order of version numbers, so you will find 2.5.x and 2.6.x releases intersperced.