topic Re: IPSec VPN with cert authentication: RSA_verify failed in General Topics

IPSec VPN with cert authentication: RSA_verify failed

Carracido — Thu, 22 Nov 2018 17:42:05 GMT

Hello community!

Created a VPN Palo Alto - Cisco Asa with certificates for Ikev2 gateway authentication.

Cannot establish the VPN. Did a debug and get the following error when the palo alto is trying to validate the ASA´s certificate

[PERR]: RSA_verify failed: 1099255804384:error:04091064:rsa routines:INT_RSA_VERIFY:algorithm mismatch:rsa_sign.c:269:
[PERR]: Invalid SIG.
[DUMP]: { 1: }: result: -1
[PERR]: { 1: }: x.x.x.x[500] - y.y.y.y[500]:0xffe400f8e0 authentication failure
[INFO]: { 1: }: x.x.x.x[500] - y.y.y.y[500]:0xffe400f8e0 authentication result: failure
[DUMP]: { 1: }: ikev2_abort(0xffe40055e0, 14)

Did anyone have the same error?

The certificate looks fine and it was working in a previous VPN ASA - ASA

Thanks in advance,

Marcos.

Re: IPSec VPN with cert authentication: RSA_verify failed

BPry — Sun, 25 Nov 2018 17:21:35 GMT

@Carracido,

The logs you have listed are complaining about an algorithm mismatch on the cert; until you get that cleared up this will never pass IKEv2. Did you regenerate the certificates specific to this tunnel or are you trying to utilize the default ASA cert for this?

Re: IPSec VPN with cert authentication: RSA_verify failed

tisc — Fri, 13 Sep 2019 09:43:05 GMT

@BPry

what exactly do you mean by algorithm mismatch on the cert? The certificates don't have to be the same. I dont really understand what you mean here.

We are facing this issue any hint would be great!

Thanks

Re: IPSec VPN with cert authentication: RSA_verify failed

Carracido — Fri, 13 Sep 2019 10:10:09 GMT

Hi Tisc,

Palo Alto involved Engineering Ipsec team to work on the certificate issue, through an Engineering case : PAN-109745

But cannot find this addressed issue in any existing current relase notes.

Regards.