<html>Hello,<br /><br />thank you very much guys.<br /><br />Best regards<br /><br />Am Dienstag, Oktober 23, 2018 19:39 CEST, bls s <bls3427@outlook.com> schrieb:<br /> <blockquote type="cite" cite="CO2PR07MB25674679397255633A7D9A1EA3F50@CO2PR07MB2567.namprd07.prod.outlook.com"> </blockquote><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta name="Generator" content="Microsoft Word 15 (filtered medium)"><style type="text/css"><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:"Courier New";}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><div class="WordSection1"><p class="MsoNormal">I’m using the new swanctl strongSwan support, but I’m pretty sure that the certs item in a connection’s local description is the same as leftcert.</p><p class="MsoNormal"><o:p> </o:p></p><p class="MsoNormal">My understanding is that the cert is used by the client to validate that it’s talking to the server that it thinks it connected to. Obviously the CA can be validated. Windows and iOS clients also validate against the altNames to provide an extra level of assurance. Windows checks that the hostname it connected to is one of the altNames, and iOS checks that the RemoteID in the VPN configuration is one of the altNames.</p><p class="MsoNormal"><o:p> </o:p></p><p class="MsoNormal">Not sure about MacOS and Android (yet), but they are undoubtedly similar.</p><p class="MsoNormal"><o:p> </o:p></p><div style="mso-element:para-border-div;border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in"><p class="MsoNormal" style="border:none;padding:0in"><b>From: </b><a href="mailto:mm@v-net.tk">Markus Maurer</a><br /><b>Sent: </b>Tuesday, October 23, 2018 7:16 AM<br /><b>To: </b><a href="mailto:users@lists.strongswan.org">users@lists.strongswan.org</a><br /><b>Subject: </b>[strongSwan] leftcert ikev2</p></div><p class="MsoNormal"><o:p> </o:p></p></div><div>Hi,<br />can anybody explain me why leftcert is needed in ikev2? What is it used for? I couldn't find an explanation about it.<br /><br />Thanks in advance!<pre>--
This email was Malware checked by UTM 9. http://www.sophos.com</pre></div><pre>--
This email was Malware checked by UTM 9. http://www.sophos.com</pre><br /><br /><br /> </html>
<pre>
--
This email was Malware checked by UTM 9. http://www.sophos.com</pre>