search

trailofbits / algo

Set up a personal VPN in the cloud
https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-that-works/
GNU Affero General Public License v3.0
28.93k stars 2.32k forks source link

Can't connect from StrongSwan on Android #867

Closed mavolkov closed 6 years ago

mavolkov commented 6 years ago

OS / Environment (where do you run Algo on)

I ran algo to setup server on mac, but can't connect from Android

Cloud Provider (where do you deploy Algo to)

DigitalOcean

Summary of the problem

I ran Algo on my mac and adjusted server. VPN worked on Mac. But when I tried to connect from StrongSwan Android, I couldn't do this. I added VPN profile, but when tried to connect he program wrote: Failed to establish VPN: server authentication failed. Please, help to fix this problem.

Steps to reproduce the behavior

  1. Set server from mac
  2. Ran vpn on mac
  3. Add VPN profile in StrongSwan on Android
  4. Got the message: "Failed to establish VPN: server authentication failed. Please, help to fix this problem."
  5. Can't connect.

Full log

strongSwan 1.9.6 Log File

Apr  5 02:31:39 00[DMN] Starting IKE charon daemon (strongSwan 5.6.1dr3, Android 7.0 - NRD90M.A320FXXU3BRB1/2018-02-01, SM-A320F - samsung/a3y17ltexx/samsung, Linux 3.18.14-13053207, armv8l)
Apr  5 02:31:39 00[LIB] loaded plugins: androidbridge charon android-log openssl fips-prf random nonce pubkey chapoly curve25519 pkcs1 pkcs8 pem xcbc hmac socket-default revocation eap-identity eap-mschapv2 eap-md5 eap-gtc eap-tls x509
Apr  5 02:31:39 00[JOB] spawning 16 worker threads
Apr  5 02:31:39 08[CFG] loaded user certificate 'CN=1st' and private key
Apr  5 02:31:39 08[IKE] initiating IKE_SA android[4] to 174.138.5.95
Apr  5 02:31:39 08[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
Apr  5 02:31:39 08[NET] sending packet: from 10.230.185.134[34561] to 174.138.5.95[500] (704 bytes)
Apr  5 02:31:39 10[NET] received packet: from 174.138.5.95[500] to 10.230.185.134[34561] (289 bytes)
Apr  5 02:31:39 10[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(FRAG_SUP) N(HASH_ALG) N(MULT_AUTH) ]
Apr  5 02:31:39 10[IKE] local host is behind NAT, sending keep alives
Apr  5 02:31:39 10[IKE] received 1 cert requests for an unknown ca
Apr  5 02:31:39 10[IKE] sending cert request for "C=CN, O=WoSign CA Limited, CN=CA WoSign ECC Root"
Apr  5 02:31:39 10[IKE] sending cert request for "C=FR, O=Certinomis, OU=0002 433998903, CN=Certinomis - Autorit?? Racine"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, O=IdenTrust, CN=IdenTrust Public Sector Root CA 1"
Apr  5 02:31:39 10[IKE] sending cert request for "C=NL, O=Staat der Nederlanden, CN=Staat der Nederlanden EV Root CA"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA"
Apr  5 02:31:39 10[IKE] sending cert request for "OU=GlobalSign Root CA - R3, O=GlobalSign, CN=GlobalSign"
Apr  5 02:31:39 10[IKE] sending cert request for "C=IT, L=Milan, O=Actalis S.p.A./03358520967, CN=Actalis Authentication Root CA"
Apr  5 02:31:39 10[IKE] sending cert request for "C=JP, O=SECOM Trust.net, OU=Security Communication RootCA1"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, O=IdenTrust, CN=IdenTrust Commercial Root CA 1"
Apr  5 02:31:39 10[IKE] sending cert request for "C=JP, O=Japanese Government, OU=ApplicationCA"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, O=Starfield Technologies, Inc., OU=Starfield Class 2 Certification Authority"
Apr  5 02:31:39 10[IKE] sending cert request for "C=TW, O=Chunghwa Telecom Co., Ltd., OU=ePKI Root Certification Authority"
Apr  5 02:31:39 10[IKE] sending cert request for "C=RO, O=certSIGN, OU=certSIGN ROOT CA"
Apr  5 02:31:39 10[IKE] sending cert request for "C=FR, O=Dhimyotis, CN=Certigna"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, O=GeoTrust Inc., CN=GeoTrust Universal CA 2"
Apr  5 02:31:39 10[IKE] sending cert request for "C=CN, O=WoSign CA Limited, CN=Certification Authority of WoSign G2"
Apr  5 02:31:39 10[IKE] sending cert request for "O=RSA Security Inc, OU=RSA Security 2048 V3"
Apr  5 02:31:39 10[IKE] sending cert request for "C=NO, O=Buypass AS-983163327, CN=Buypass Class 2 Root CA"
Apr  5 02:31:39 10[IKE] sending cert request for "C=SK, L=Bratislava, O=Disig a.s., CN=CA Disig Root R2"
Apr  5 02:31:39 10[IKE] sending cert request for "C=TR, L=Ankara, O=E-Tu??ra EBG Bili??im Teknolojileri ve Hizmetleri A.??., OU=E-Tugra Sertifikasyon Merkezi, CN=E-Tugra Certification Authority"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Trusted Root G4"
Apr  5 02:31:39 10[IKE] sending cert request for "C=TR, L=Gebze - Kocaeli, O=T??rkiye Bilimsel ve Teknolojik Ara??t??rma Kurumu - T??B??TAK, OU=Ulusal Elektronik ve Kriptoloji Ara??t??rma Enstit??s?? - UEKAE, OU=Kamu Sertifikasyon Merkezi, CN=T??B??TAK UEKAE K??k Sertifika Hizmet Sa??lay??c??s?? - S??r??m 3"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, O=GeoTrust Inc., CN=GeoTrust Primary Certification Authority"
Apr  5 02:31:39 10[IKE] sending cert request for "C=SK, L=Bratislava, O=Disig a.s., CN=CA Disig Root R1"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root G2"
Apr  5 02:31:39 10[IKE] sending cert request for "C=FR, ST=France, L=Paris, O=PM/SGDN, OU=DCSSI, CN=IGC/A, E=igca@sgdn.pm.gouv.fr"
Apr  5 02:31:39 10[IKE] sending cert request for "C=CH, O=SwissSign AG, CN=SwissSign Gold CA - G2"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, O=SecureTrust Corporation, CN=SecureTrust CA"
Apr  5 02:31:39 10[IKE] sending cert request for "C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=Trusted Certificate Services"
Apr  5 02:31:39 10[IKE] sending cert request for "C=SE, O=AddTrust AB, OU=AddTrust TTP Network, CN=AddTrust Qualified CA Root"
Apr  5 02:31:39 10[IKE] sending cert request for "C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA"
Apr  5 02:31:39 10[IKE] sending cert request for "C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 3"
Apr  5 02:31:39 10[IKE] sending cert request for "C=GR, O=Hellenic Academic and Research Institutions Cert. Authority, CN=Hellenic Academic and Research Institutions RootCA 2011"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA"
Apr  5 02:31:39 10[IKE] sending cert request for "CN=ACCVRAIZ1, OU=PKIACCV, O=ACCV, C=ES"
Apr  5 02:31:39 10[IKE] sending cert request for "C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 2 G3"
Apr  5 02:31:39 10[IKE] sending cert request for "O=Cybertrust, Inc, CN=Cybertrust Global Root"
Apr  5 02:31:39 10[IKE] sending cert request for "C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 2"
Apr  5 02:31:39 10[IKE] sending cert request for "C=TW, O=TAIWAN-CA, OU=Root CA, CN=TWCA Global Root CA"
Apr  5 02:31:39 10[IKE] sending cert request for "C=ch, O=Swisscom, OU=Digital Certificate Services, CN=Swisscom Root CA 2"
Apr  5 02:31:39 10[IKE] sending cert request for "C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO ECC Certification Authority"
Apr  5 02:31:39 10[IKE] sending cert request for "C=ch, O=Swisscom, OU=Digital Certificate Services, CN=Swisscom Root CA 1"
Apr  5 02:31:39 10[IKE] sending cert request for "C=HK, O=Hongkong Post, CN=Hongkong Post Root CA 1"
Apr  5 02:31:39 10[IKE] sending cert request for "C=IL, O=StartCom Ltd., CN=StartCom Certification Authority G2"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, O=GeoTrust Inc., CN=GeoTrust Global CA 2"
Apr  5 02:31:39 10[IKE] sending cert request for "C=NL, O=Staat der Nederlanden, CN=Staat der Nederlanden Root CA - G3"
Apr  5 02:31:39 10[IKE] sending cert request for "C=HU, L=Budapest, O=Microsec Ltd., CN=Microsec e-Szigno Root CA 2009, E=info@e-szigno.hu"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, O=AffirmTrust, CN=AffirmTrust Commercial"
Apr  5 02:31:39 10[IKE] sending cert request for "C=ES, O=Agencia Catalana de Certificacio (NIF Q-0801176-I), OU=Serveis Publics de Certificacio, OU=Vegeu https://www.catcert.net/verarrel (c)03, OU=Jerarquia Entitats de Certificacio Catalanes, CN=EC-ACC"
Apr  5 02:31:39 10[IKE] sending cert request for "C=FR, O=Certinomis, OU=0002 433998903, CN=Certinomis - Root CA"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, ST=Arizona, L=Scottsdale, O=Starfield Technologies, Inc., CN=Starfield Services Root Certificate Authority - G2"
Apr  5 02:31:39 10[IKE] sending cert request for "C=DE, O=D-Trust GmbH, CN=D-TRUST Root Class 3 CA 2 EV 2009"
Apr  5 02:31:39 10[IKE] sending cert request for "C=ES, CN=Autoridad de Certificacion Firmaprofesional CIF A62634068"
Apr  5 02:31:39 10[IKE] sending cert request for "E=pki@sk.ee, C=EE, O=AS Sertifitseerimiskeskus, CN=Juur-SK"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2006 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA"
Apr  5 02:31:39 10[IKE] sending cert request for "C=ch, O=Swisscom, OU=Digital Certificate Services, CN=Swisscom Root EV CA 2"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, O=Entrust, Inc., OU=www.entrust.net/CPS is incorporated by reference, OU=(c) 2006 Entrust, Inc., CN=Entrust Root Certification Authority"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Hardware"
Apr  5 02:31:39 10[IKE] sending cert request for "C=ES, O=Generalitat Valenciana, OU=PKIGVA, CN=Root CA Generalitat Valenciana"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, O=thawte, Inc., OU=(c) 2007 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA - G2"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., CN=Go Daddy Root Certificate Authority - G2"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, O=Digital Signature Trust, OU=DST ACES, CN=DST ACES CA X6"
Apr  5 02:31:39 10[IKE] sending cert request for "C=CH, O=WISeKey, OU=OISTE Foundation Endorsed, CN=OISTE WISeKey Global Root GB CA"
Apr  5 02:31:39 10[IKE] sending cert request for "C=ES, O=IZENPE S.A., CN=Izenpe.com"
Apr  5 02:31:39 10[IKE] sending cert request for "CN=Atos TrustedRoot 2011, O=Atos, C=DE"
Apr  5 02:31:39 10[IKE] sending cert request for "C=EU, L=Madrid (see current address at www.camerfirma.com/address), SN=A82743287, O=AC Camerfirma S.A., CN=Chambers of Commerce Root - 2008"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, O=Network Solutions L.L.C., CN=Network Solutions Certificate Authority"
Apr  5 02:31:39 10[IKE] sending cert request for "C=TR, L=Ankara, O=T??RKTRUST Bilgi ??leti??im ve Bili??im G??venli??i Hizmetleri A.??., CN=T??RKTRUST Elektronik Sertifika Hizmet Sa??lay??c??s?? H6"
Apr  5 02:31:39 10[IKE] sending cert request for "C=FR, O=Certplus, CN=Class 2 Primary CA"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, O=GeoTrust Inc., OU=(c) 2008 GeoTrust Inc. - For authorized use only, CN=GeoTrust Primary Certification Authority - G3"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, O=GeoTrust Inc., OU=(c) 2007 GeoTrust Inc. - For authorized use only, CN=GeoTrust Primary Certification Authority - G2"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2008 VeriSign, Inc. - For authorized use only, CN=VeriSign Universal Root Certification Authority"
Apr  5 02:31:39 10[IKE] sending cert request for "C=BM, O=QuoVadis Limited, OU=Root Certification Authority, CN=QuoVadis Root Certification Authority"
Apr  5 02:31:39 10[IKE] sending cert request for "C=DE, O=T-Systems Enterprise Services GmbH, OU=T-Systems Trust Center, CN=T-TeleSec GlobalRoot Class 2"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root G3"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root G2"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, ST=Arizona, L=Scottsdale, O=Starfield Technologies, Inc., CN=Starfield Root Certificate Authority - G2"
Apr  5 02:31:39 10[IKE] sending cert request for "C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services"
Apr  5 02:31:39 10[IKE] sending cert request for "C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=Secure Certificate Services"
Apr  5 02:31:39 10[IKE] sending cert request for "C=TW, O=TAIWAN-CA, OU=Root CA, CN=TWCA Root Certification Authority"
Apr  5 02:31:39 10[IKE] sending cert request for "C=JP, O=SECOM Trust Systems CO.,LTD., OU=Security Communication EV RootCA1"
Apr  5 02:31:39 10[IKE] sending cert request for "C=TR, L=Ankara, O=T??RKTRUST Bilgi ??leti??im ve Bili??im G??venli??i Hizmetleri A.??., CN=T??RKTRUST Elektronik Sertifika Hizmet Sa??lay??c??s?? H5"
Apr  5 02:31:39 10[IKE] sending cert request for "C=NO, O=Buypass AS-983163327, CN=Buypass Class 2 CA 1"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, O=VISA, OU=Visa International Service Association, CN=Visa eCommerce Root"
Apr  5 02:31:39 10[IKE] sending cert request for "C=HU, L=Budapest, O=NetLock Kft., OU=Tan??s??tv??nykiad??k (Certification Services), CN=NetLock Arany (Class Gold) F??tan??s??tv??ny"
Apr  5 02:31:39 10[IKE] sending cert request for "C=FI, O=Sonera, CN=Sonera Class2 CA"
Apr  5 02:31:39 10[IKE] sending cert request for "C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 1 G3"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2007 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G4"
Apr  5 02:31:39 10[IKE] sending cert request for "OU=GlobalSign ECC Root CA - R4, O=GlobalSign, CN=GlobalSign"
Apr  5 02:31:39 10[IKE] sending cert request for "C=GB, O=Trustis Limited, OU=Trustis FPS Root CA"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root G3"
Apr  5 02:31:39 10[IKE] sending cert request for "CN=ACEDICOM Root, OU=PKI, O=EDICOM, C=ES"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2 Certification Authority"
Apr  5 02:31:39 10[IKE] sending cert request for "C=CN, O=WoSign CA Limited, CN=Certification Authority of WoSign"
Apr  5 02:31:39 10[IKE] sending cert request for "C=PL, O=Unizeto Technologies S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA 2"
Apr  5 02:31:39 10[IKE] sending cert request for "C=IL, O=StartCom Ltd., OU=Secure Digital Certificate Signing, CN=StartCom Certification Authority"
Apr  5 02:31:39 10[IKE] sending cert request for "C=IL, O=StartCom Ltd., OU=Secure Digital Certificate Signing, CN=StartCom Certification Authority"
Apr  5 02:31:39 10[IKE] sending cert request for "O=Digital Signature Trust Co., CN=DST Root CA X3"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2008 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA - G3"
Apr  5 02:31:39 10[IKE] sending cert request for "C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 3 G3"
Apr  5 02:31:39 10[IKE] sending cert request for "C=SE, O=AddTrust AB, OU=AddTrust TTP Network, CN=AddTrust Public CA Root"
Apr  5 02:31:39 10[IKE] sending cert request for "C=JP, O=Japan Certification Services, Inc., CN=SecureSign RootCA11"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, O=SecureTrust Corporation, CN=Secure Global CA"
Apr  5 02:31:39 10[IKE] sending cert request for "CN=EBG Elektronik Sertifika Hizmet Sa??lay??c??s??, O=EBG Bili??im Teknolojileri ve Hizmetleri A.??., C=TR"
Apr  5 02:31:39 10[IKE] sending cert request for "O=Entrust.net, OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Certification Authority (2048)"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, O=GeoTrust Inc., CN=GeoTrust Global CA"
Apr  5 02:31:39 10[IKE] sending cert request for "C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root"
Apr  5 02:31:39 10[IKE] sending cert request for "C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification Authority"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, O=Entrust, Inc., OU=See www.entrust.net/legal-terms, OU=(c) 2009 Entrust, Inc. - for authorized use only, CN=Entrust Root Certification Authority - G2"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G5"
Apr  5 02:31:39 10[IKE] sending cert request for "C=DE, O=T-Systems Enterprise Services GmbH, OU=T-Systems Trust Center, CN=T-TeleSec GlobalRoot Class 3"
Apr  5 02:31:39 10[IKE] sending cert request for "C=CH, O=WISeKey, OU=Copyright (c) 2005, OU=OISTE Foundation Endorsed, CN=OISTE WISeKey Global Root GA CA"
Apr  5 02:31:39 10[IKE] sending cert request for "C=EE, O=AS Sertifitseerimiskeskus, CN=EE Certification Centre Root CA, E=pki@sk.ee"
Apr  5 02:31:39 10[IKE] sending cert request for "C=JP, O=SECOM Trust Systems CO.,LTD., OU=Security Communication RootCA2"
Apr  5 02:31:39 10[IKE] sending cert request for "OU=GlobalSign Root CA - R2, O=GlobalSign, CN=GlobalSign"
Apr  5 02:31:39 10[IKE] sending cert request for "C=PL, O=Krajowa Izba Rozliczeniowa S.A., CN=SZAFIR ROOT CA2"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, O=AffirmTrust, CN=AffirmTrust Premium ECC"
Apr  5 02:31:39 10[IKE] sending cert request for "C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO Certification Authority"
Apr  5 02:31:39 10[IKE] sending cert request for "C=SE, O=AddTrust AB, OU=AddTrust TTP Network, CN=AddTrust Class 1 CA Root"
Apr  5 02:31:39 10[IKE] sending cert request for "C=NO, O=Buypass AS-983163327, CN=Buypass Class 3 Root CA"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, O=AffirmTrust, CN=AffirmTrust Premium"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, OU=www.xrampsecurity.com, O=XRamp Security Services Inc, CN=XRamp Global Certification Authority"
Apr  5 02:31:39 10[IKE] sending cert request for "C=CN, O=China Internet Network Information Center, CN=China Internet Network Information Center EV Certificates Root"
Apr  5 02:31:39 10[IKE] sending cert request for "O=TeliaSonera, CN=TeliaSonera Root CA v1"
Apr  5 02:31:39 10[IKE] sending cert request for "C=IE, O=Baltimore, OU=CyberTrust, CN=Baltimore CyberTrust Root"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, O=GeoTrust Inc., CN=GeoTrust Universal CA"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, O=Wells Fargo WellsSecure, OU=Wells Fargo Bank NA, CN=WellsSecure Public Root Certificate Authority"
Apr  5 02:31:39 10[IKE] sending cert request for "C=HU, L=Budapest, O=Microsec Ltd., OU=e-Szigno CA, CN=Microsec e-Szigno Root CA"
Apr  5 02:31:39 10[IKE] sending cert request for "OU=GlobalSign ECC Root CA - R5, O=GlobalSign, CN=GlobalSign"
Apr  5 02:31:39 10[IKE] sending cert request for "C=DE, O=Deutsche Telekom AG, OU=T-TeleSec Trust Center, CN=Deutsche Telekom Root CA 2"
Apr  5 02:31:39 10[IKE] sending cert request for "C=EU, O=AC Camerfirma SA CIF A82743287, OU=http://www.chambersign.org, CN=Global Chambersign Root"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, O=Entrust, Inc., OU=See www.entrust.net/legal-terms, OU=(c) 2012 Entrust, Inc. - for authorized use only, CN=Entrust Root Certification Authority - EC1"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust ECC Certification Authority"
Apr  5 02:31:39 10[IKE] sending cert request for "C=CH, O=SwissSign AG, CN=SwissSign Silver CA - G2"
Apr  5 02:31:39 10[IKE] sending cert request for "C=DE, O=D-Trust GmbH, CN=D-TRUST Root Class 3 CA 2 2009"
Apr  5 02:31:39 10[IKE] sending cert request for "C=PL, O=Unizeto Sp. z o.o., CN=Certum CA"
Apr  5 02:31:39 10[IKE] sending cert request for "C=TW, O=Government Root Certification Authority"
Apr  5 02:31:39 10[IKE] sending cert request for "C=EU, L=Madrid (see current address at www.camerfirma.com/address), SN=A82743287, O=AC Camerfirma S.A., CN=Global Chambersign Root - 2008"
Apr  5 02:31:39 10[IKE] sending cert request for "C=NL, O=Staat der Nederlanden, CN=Staat der Nederlanden Root CA - G2"
Apr  5 02:31:39 10[IKE] sending cert request for "C=CN, O=China Financial Certification Authority, CN=CFCA EV ROOT"
Apr  5 02:31:39 10[IKE] sending cert request for "C=PL, O=Unizeto Technologies S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA"
Apr  5 02:31:39 10[IKE] sending cert request for "CN=T??RKTRUST Elektronik Sertifika Hizmet Sa??lay??c??s??, C=TR, L=Ankara, O=T??RKTRUST Bilgi ??leti??im ve Bili??im G??venli??i Hizmetleri A.??. (c) Aral??k 2007"
Apr  5 02:31:39 10[IKE] sending cert request for "C=EU, O=AC Camerfirma SA CIF A82743287, OU=http://www.chambersign.org, CN=Chambers of Commerce Root"
Apr  5 02:31:39 10[IKE] sending cert request for "C=CN, O=WoSign CA Limited, CN=CA ???????????????"
Apr  5 02:31:39 10[IKE] sending cert request for "C=US, O=AffirmTrust, CN=AffirmTrust Networking"
Apr  5 02:31:39 10[IKE] authentication of 'CN=1st' (myself) with ECDSA_WITH_SHA256_DER successful
Apr  5 02:31:39 10[IKE] sending end entity cert "CN=1st"
Apr  5 02:31:39 10[IKE] establishing CHILD_SA android{2}
Apr  5 02:31:39 10[ENC] generating IKE_AUTH request 1 [ IDi CERT N(INIT_CONTACT) CERTREQ AUTH CPRQ(ADDR ADDR6 DNS DNS6) N(ESP_TFC_PAD_N) SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(MULT_AUTH) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]
Apr  5 02:31:39 10[ENC] splitting IKE message with length of 4026 bytes into 4 fragments
Apr  5 02:31:39 10[ENC] generating IKE_AUTH request 1 [ EF(1/4) ]
Apr  5 02:31:39 10[ENC] generating IKE_AUTH request 1 [ EF(2/4) ]
Apr  5 02:31:39 10[ENC] generating IKE_AUTH request 1 [ EF(3/4) ]
Apr  5 02:31:39 10[ENC] generating IKE_AUTH request 1 [ EF(4/4) ]
Apr  5 02:31:39 10[NET] sending packet: from 10.230.185.134[56978] to 174.138.5.95[4500] (1368 bytes)
Apr  5 02:31:39 10[NET] sending packet: from 10.230.185.134[56978] to 174.138.5.95[4500] (1368 bytes)
Apr  5 02:31:39 10[NET] sending packet: from 10.230.185.134[56978] to 174.138.5.95[4500] (1368 bytes)
Apr  5 02:31:39 10[NET] sending packet: from 10.230.185.134[56978] to 174.138.5.95[4500] (109 bytes)
Apr  5 02:31:39 11[NET] received packet: from 174.138.5.95[4500] to 10.230.185.134[56978] (544 bytes)
Apr  5 02:31:39 11[ENC] parsed IKE_AUTH response 1 [ EF(1/2) ]
Apr  5 02:31:39 11[ENC] received fragment #1 of 2, waiting for complete IKE message
Apr  5 02:31:39 12[NET] received packet: from 174.138.5.95[4500] to 10.230.185.134[56978] (433 bytes)
Apr  5 02:31:39 12[ENC] parsed IKE_AUTH response 1 [ EF(2/2) ]
Apr  5 02:31:39 12[ENC] received fragment #2 of 2, reassembling fragmented IKE message
Apr  5 02:31:39 12[ENC] parsed IKE_AUTH response 1 [ IDr CERT AUTH CPRP(ADDR ADDR6 DNS) SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_6_ADDR) ]
Apr  5 02:31:39 12[IKE] received end entity cert "CN=174.138.5.95"
Apr  5 02:31:39 12[CFG]   using certificate "CN=174.138.5.95"
Apr  5 02:31:39 12[CFG] no issuer certificate found for "CN=174.138.5.95"
Apr  5 02:31:39 12[CFG]   issuer is "CN=174.138.5.95"
Apr  5 02:31:39 12[IKE] no trusted ECDSA public key found for '174.138.5.95'
Apr  5 02:31:39 12[ENC] generating INFORMATIONAL request 2 [ N(AUTH_FAILED) ]
Apr  5 02:31:39 12[NET] sending packet: from 10.230.185.134[56978] to 174.138.5.95[4500] (65 bytes)
jackivanov commented 6 years ago

Duplicate https://github.com/trailofbits/algo/issues/836. Fixed already