Freebox Server (Pop V8/ Delta V7 / Revolution V6 / Server Mini 4K)

Concerne le projet: Freebox Server (Pop V8/ Delta V7 / Revolution V6 / Server Mini 4K)
Ouverte par Chevry (eric2gif) - 26/08/2017
Dernière édition par Romain FLIEDEL (rfliedel) - 09/01/2019

Lors des tentatives d’établissement du VPN par un client, le serveur Freebox transmet un certificat Let’s Encrypt expiré.
Voici les logs prises sur le client Strongswan:

initiating IKE_SA vpn-freebox[1] to xx.xx.xx.xx
generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(HASH_ALG) ]
sending packet: from 192.168.0.15[500] to xx.xx.xx.xx[500] (724 bytes)
received packet: from xx.xx.xx.xx[500] to 192.168.0.15[500] (456 bytes)
parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(HASH_ALG) N(MULT_AUTH) ]
remote host is behind NAT
sending cert request for “C=US, O=Let’s Encrypt, CN=Let’s Encrypt Authority X3” sending cert request for “C=US, O=Internet Security Research Group, CN=ISRG Root X1” sending cert request for “C=US, O=Let’s Encrypt, CN=Let’s Encrypt Authority X3” no IDi configured, fall back on IP address
establishing CHILD_SA vpn-freebox
generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) CERTREQ CPRQ(ADDR DNS) SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(MULT_AUTH) N(EAP_ONLY) ]
sending packet: from 192.168.0.15[4500] to xx.xx.xx.xx[4500] (428 bytes)
retransmit 1 of request with message ID 1
sending packet: from 192.168.0.15[4500] to xx.xx.xx.xx[4500] (428 bytes)
retransmit 2 of request with message ID 1
sending packet: from 192.168.0.15[4500] to xx.xx.xx.xx[4500] (428 bytes)
retransmit 3 of request with message ID 1
sending packet: from 192.168.0.15[4500] to xx.xx.xx.xx[4500] (428 bytes)
received packet: from xx.xx.xx.xx[4500] to 192.168.0.15[4500] (2860 bytes)
parsed IKE_AUTH response 1 [ IDr CERT CERT AUTH EAP/REQ/ID ]
received end entity cert “CN=xxx.freeboxos.fr” received issuer cert “C=US, O=Let’s Encrypt, CN=Let’s Encrypt Authority X3”

using certificate "CN=xxx.freeboxos.fr"
using trusted intermediate ca certificate "C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3"

subject certificate invalid (valid from May 20 10:11:00 2017 to Aug 18 10:11:00 2017)
no trusted RSA public key found for ‘xxx.freeboxos.fr’ generating INFORMATIONAL request 2 [ N(AUTH_FAILED) ]
sending packet: from 192.168.0.15[4500] to 83.152.214.136[4500] (76 bytes)
establishing connection ‘vpn-freebox’ failed

---

Résultat de la commande ipsec listcerts:

List of X.509 End Entity Certificates:

  altNames:  xxx.freeboxos.fr
  subject:  "CN=xxx.freeboxos.fr"
  issuer:   "C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3"
  serial:    03:4c:98:fc:74:89:7b:80:14:d0:ff:b9:6d:fb:29:4a:ef:09
  validity:  not before May 20 10:11:00 2017, ok
             not after  Aug 18 10:11:00 2017, expired (8 days ago)
  pubkey:    RSA 2048 bits
  keyid:     3b:ba:bf:89:77:da:38:1e:c9:0e:d6:14:75:2a:89:ad:15:3f:78:f1
  subjkey:   27:fd:76:44:4c:f2:2a:72:17:15:20:d7:b2:6b:c0:a7:b2:ed:d3:9d
  authkey:   a8:4a:6a:63:04:7d:dd:ba:e6:d1:39:b7:a6:45:65:ef:f3:a8:ec:a1

Par ailleurs, sur l’interface web du serveur freebox, page “Nom de domaine personnalisé”, il est indiqué que le certificat est valide et expirera dans 68 jours.
Existe-t-il une méthode pour forcer la mise d’un certificat Let’s Encrypt?
Pourquoi y a-t-il une désynchronisation entre le certificat réellement utilisé et les indications de validité sur la page web d’administration?

Close par  Romain FLIEDEL (rfliedel)
mercredi 9 janvier, 2019 12:15:08
Raison de clôture :  Impossible à reproduire

Cette tache ne dépend pas d'autre tache