Re: Iked, ca_getreq: no valid local certificate found

2015-11-05 Thread Jonathan Gray
On Fri, Nov 06, 2015 at 12:24:30AM -0500, Toyam Cox wrote: > I'm running 5.8-release. ikectl ca in 5.8 is non-functional as LibreSSL removed support for environment variables in openssl cnf files and this was not noticed/fixed until after 5.8. Here is a patch against 5.8 that adds the changes to

Re: Iked, ca_getreq: no valid local certificate found

2015-11-05 Thread Toyam Cox
I'm running 5.8-release. On Thu, Nov 5, 2015 at 8:07 PM, Jonathan Gray wrote: > Which release or snapshot are you running? For the version of the file > Reyk pointed you at you'll need a -current snapshot. > > On Thu, Nov 05, 2015 at 12:58:29PM -0500, Toyam Cox wrote: >> This got me past that er

Re: Iked, ca_getreq: no valid local certificate found

2015-11-05 Thread Jonathan Gray
Which release or snapshot are you running? For the version of the file Reyk pointed you at you'll need a -current snapshot. On Thu, Nov 05, 2015 at 12:58:29PM -0500, Toyam Cox wrote: > This got me past that error pretty handidly. > > However, now it is complaining about no index.txt. The path gi

Re: Iked, ca_getreq: no valid local certificate found

2015-11-05 Thread Toyam Cox
This got me past that error pretty handidly. However, now it is complaining about no index.txt. The path given doesn't help me know where to put the index.txt Getting Private key Using configuration from /etc/ssl/ikeca.cnf index.txt: No such file or directory unable to open 'index.txt' 2501201222

Re: Iked, ca_getreq: no valid local certificate found

2015-11-05 Thread Reyk Floeter
Copy ikeca.cnf from the ipsecctl source tree to /etc/ssl/ and retry. http://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/src/usr.sbin/ikectl/ikeca .cnf The openssl.cnf version broke and we somehow didn't install ikeca.cnf by default. Reyk > On 05.11.2015, at 08:28, Toyam Cox wrote: > > Ho misc

Re: Iked, ca_getreq: no valid local certificate found

2015-11-05 Thread Giancarlo Razzolini
Em 05-11-2015 05:28, Toyam Cox escreveu: > Unfortunately, editing /etc/ssl/x509v3.cnf didn't work for me. > Variable lookup still failed. You need to recreate the certs. Each time you create one, you'll need to edit x509v3 to match the cert being created. At least this did the trick for me. Cheers