How to authenticate to racoon with a certificate chain if only the root CA is known

Question

I'm trying to setup IPsec using x509 certificates on Linux. I'm using racoon for that task. I've come to the point where the authentication works fine if I keep every link of the certificate chain on every host. My goal is to authenticate each other knowing only the Root CA.

For example: for the hosts "Alice" and "Bob" the chain of certification looks like this

Root-CA -> MajorCA -> MinorCA -> (Alice/Bob)

Where Root-CA is self-signed and so on. Certificates that Alice knows are

Alice.key
Alice.crt
Root-CA.crt
MajorCA.crt
MinorCA.crt

Certificates that Bob knows are

Bob.key
Bob.crt
Root-CA.crt
MajorCA.crt
MinorCA.crt

Now everything works fine in this constellation. Alice sends

Hey, I'm Alice, and this is my certificate
"Alice.crt"

to Bob and Bob can reconstruct the entire chain to

Root-CA -> MajorCA -> MinorCA -> "Alice"

What I'm trying to realize and I'm not sure if this is possible at all is to authenticate a host via the Root-CA, regardless of the rest of the chain, which has to be provided by the host itself. E.g.

Bob knows only the following certificates

Bob.key
Bob.crt
Root-CA.crt

and Alice authenticates herself to Bob by sending

Hey, I'm Alice, and this is my certificate chain
[Root-CA.crt] -> "MajorCA.crt -> MinorCA.crt -> Alice.crt"

either with or without the Root-CA certificate.

Now Bob should be able to reconstruct the chain to

Root-CA -> "MajorCA -> MinorCA -> Alice"

and therefore authenticate Alice.

I know that some CA certificates come as bundled PEM files and I know that it is possible to bundle the entire chain as PKCS12 file. But racoon does not support PKCS12 (or does it?) and it ignores additional certificates in a PEM bundle (and only takes the first one).

Now my question :-)

Does anyone know how to realize this (using racoon) and make the scenario work, or does anyone know that this will surely not work because of reasons they can explain?

Regards,

fr00tyl00p :-)

Answer 1

In IKE v2, it is possible for any machine to send several certificates, its own and a number of "helper certificates" which could help with validation, i.e. intermediate CA certificates. The standard states that:

Implementations MUST be capable of being configured to send and

accept up to four X.509 certificates in support of authentication,
and also MUST be capable of being configured to send and accept the
Hash and URL format (with HTTP URLs).  Implementations SHOULD be
capable of being configured to send and accept Raw RSA keys.  If
multiple certificates are sent, the first certificate MUST contain
the public key used to sign the AUTH payload.  The other certificates
may be sent in any order.

so it should work, as long as you can convince your tools (racoon) to send the certificates. The standard is there.

The standard alludes to the possibility of sending, on the wire, not an X.509 certificate alone, but a PKCS#7 file. A PKCS#7 file is really a large and flexible format, but often used as a container for multiple certificates (but it does not contain the private key). It may be worth a try to use such a file with your certificate_type clause (in racoon.conf).