strongswan scepclient error parsing distinguished name about strongswan

[strongX509]

The error is generated by the identification_create_from_string() function

https://github.com/strongswan/strongswan/blob/5.9.5/src/scepclient/scepclient.c#L1121

and I don't think that any Ubuntu strongSwan package is missing. Could you call scepclient with the --debug 2 option so that the actual DN being parsed is printed out?

[thrdgeek]

The dn printed is: dn: 'C=US, S=Michigan, L=Detroit, O={company}, OU=Ubuntu, CN=USFRYLNCNGLHP45'
error: parsing of distinguished name failed

The values match the declared variables.

[thrdgeek]

To add, this is the same script that has worked on prior releases of Ubuntu.

[strongX509]

Problem detected :-) You have erroneously been using S= for State which actually up to strongSwan 5.9.2 was the identifier assigned to Surname but was changed to SN= in January 2021 with the following commit d8e4a2a.

As a consequence strongSwan 5.9.5 used by Ubuntu Jammy is faulting on the now inexisting S= identifier.

Fix: In your script use the correct ST= identifier that has always been assigned to State.

[thrdgeek]

Wow, such a subtle change. Why the change, just curious? I guess I will need to build logic to detect the release and use the appropriate options. Thanks.

[thrdgeek]

It appears the 'SN' is supported in version 5.8.2 for Focal also.

[strongX509]

Using the correct identifier ST= for State works for all strongSwan versions.

[thrdgeek]

Thank you. I don't know where I got the use of SN from.