Strongswan: ike alg: unable to locate my private key

If you are using StrongSwan to establish an IPSec connection and you encounter this error:

root@crackjack:~# ipsec up conn-to-td
002 "conn-to-td" #2: initiating Main Mode
002 "conn-to-td" #2: ike alg: unable to locate my private key
002 "conn-to-td" #2: ike alg: unable to locate my private key
003 "conn-to-td" #2: empty ISAKMP SA proposal to send (no algorithms for ike selection?)

Then I have found the way to solve the first part of your problem - the private key part. Basically, after FreeSwan became OpenSwan and then finally StrongSwan, they created a directory for each individual part under /etc/ipsec.d. So for example the CA certs are stored in the folder /etc/ipsec.d/cacerts, or the certs you got are stored in /etc/ipsec.d/certs. Similarly, you are supposed to store your private key at /etc/ipsec.d/private. What you have probably done is that in /etc/ipsec.conf you wrote down

leftcert=/etc/ipsec.d/private/my_private_key.pem

When in fact you should have your /etc/ipsec.conf as the following:

# ipsec.conf - strongSwan IPsec configuration file

# basic configuration

config setup
    plutodebug=all
    plutostderrlog=/var/log/pluto.log
    charonstart=yes
    plutostart=yes


conn host-to-host
      left=
      leftcert=my_cert.pem
      leftid=my_private_key.pem
      right=
      rightid=
      auto=start
      pfs=no
      rekey=no
      keyingtries=3

After this, you can do the faithful /etc/init.d/ipsec restart and the private key problem will disappear

How to see a Cisco IOS CA's root certificate

If you have created an IOS CA server and want to see its root certificate for distribution to other machines, then you must look at its storage location. Suppose you used the following to create your CA:

# enable

(config)# cry pki server thehacklist

(cs-server)# database url flash:

(cs-server)# issuer-name C=IN, ST=WB, O=thehacklist

(cs-server)# cdp none

(cs-server)# grant auto

(cs-server)# no shut

%Some server settings cannot be changed after CA certificate generation.

% Please enter a passphrase to protect the private key

% or type Return to exit

Password:

Re-enter password:

% Generating 1024 bit RSA keys, keys will be non-exportable...[OK]

% Exporting Certificate Server signing certificate and keys...

% Certificate Server enabled.

(cs-server)# end

Now if you look at the storage location (flash in this case, as specified above), you will see a three files named after your CA server (with extensions ending in ser, crl and p12).

# dir flash:

Directory of flash:/

11 -rw- 32 Jul 10 2010 17:54:20 +00:00 thehacklist.ser

1 -rw- 1826 Jan 15 2008 17:52:38 +00:00 sdmconfig-38xx.cfg

2 -rw- 6036480 Jan 15 2008 17:53:10 +00:00 sdm.tar

3 -rw- 861696 Jan 15 2008 17:53:26 +00:00 es.tar

4 -rw- 1164288 Jan 15 2008 17:53:46 +00:00 common.tar

5 -rw- 1038 Jan 15 2008 17:54:02 +00:00 home.shtml

6 -rw- 113152 Jan 15 2008 17:54:16 +00:00 home.tar

7 -rw- 1697952 Jan 15 2008 17:54:42 +00:00 securedesktop-ios-3.1.1.45-k9.pkg

8 -rw- 416354 Jan 15 2008 17:55:06 +00:00 sslclient-win-1.1.3.173.pkg

9 -rw- 59526004 Jun 29 2010 19:23:10 +00:00 c3845-advipservicesk9-mz.124-22.T2

10 -rw- 60288320 Dec 15 2008 23:27:58 +00:00 c3845-adventerprisek9-mz.124-20.T

12 -rw- 247 Jul 10 2010 17:54:20 +00:00 thehacklist.crl

13 -rw- 1627 Jul 10 2010 17:54:22 +00:00 thehacklist_00001.pem

From here, to see the root certificate of the CA, you can use:

# more flash:/thehacklist_00001.pem

-----BEGIN CERTIFICATE-----

MIIB/TCCAWagAwIBAgIBATANBgkqhkiG9w0BAQQFADASMRAwDgYDVQQDEwdjbG91

ZGNhMB4XDTEwMDUwNTIxNDI1MloXDTEzMDUwNDIxNDI1MlowEjEQMA4GA1UEAxMH

Y2xvdWRjYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAlKg0l1DdBpgc/5j3

mA8XodkRq3d5c6K4ZYgUKftEUBAJV3tQz8/ms+CObfmvOn8BdZl0vsLDhJIPRCoq

pypec//gtJpQAAo2I8PCl874yB8k/ebhxBMMhzxQ7y70B0d6gbl8Ub+pmXJnl7Gi

61G41bmNCzXHdfUUiVczpVnaaaaaaaaaaaaaaaaaaaYDVR0TAQH/BAUwAwEB/zAO

BgNVHQ8BAf8EBAMCAYYwHwYDVR0jBBgwFoAUbjpam0qXL8U93MSmngJ1vE1USrMw

HQYDVR0OBBYEFG46WptKly/FPdzEpp4CdbxNVEqzMA0GCSqGSIb3DQEBBAUAA4GB

ACDHm7NNssxSzdD1aQUyUtAni9zo2TCrdcVYtUa5z497JWAPK5YE1tGsMdkYawky

/sUuQMQY4nQFaHtlwKoDHKUSRuygq24GjCUXwoSLLR8jqzfuSgah1ZPohZUPRFEo

EAN2hDdw3Y0o75rsHzie355AH2a22nDnyAm+89EJqEsv

-----END CERTIFICATE-----