[strongSwan] FQDN based certificate authentication for ikev2

[Reshma Begam]

Hi Andreas,

Sorry for continuous queries but  needed some info on ipsec.conf for
certificates so please do the needful .

 From your last mial do you mean leftid=%fromcert will set id type as
subjectDN by default? i.e  with  below value in my case?
 subject:  "C=de, ST=Bayern, L=Munich, O=Nokia Siemens Networks, OU=RTP,
CN=ATCA_cla, E=gianluigi.ongaro at nsn.com"

Also, if 10.0.0.1 (please refer my previous mail) is the initiator  with
leftid type as always ipaddress  and i want to accept all peer id
types(fqdn/dn/ipaddress) how should be the values of right, left , rightid
and leftid on 10.0.0.1 side ? Can this be achieved by magic values or wild
card entries in simple way, without explicitly specifying them.

(Or )

Any ipsec.conf  option exist to ignore identity check of peer .



Thanks,
Reshma

*# /usr/local/6bin/ipsec stroke listall*
List of X.509 End Entity Certificates:

  altNames:  cla.atca.nsn.com
  subject:  "C=de, ST=Bayern, L=Munich, O=Nokia Siemens Networks, OU=RTP,
CN=ATCA_cla, E=gianluigi.ongaro at nsn.com"
  issuer:   "C=de, ST=Bayern, L=Munich, O=Nokia Siemens Networks, OU=RTP,
CN=www.nokiasiemensnetworks.com, E=gianluigi.ongaro at nsn.com"
  serial:    03
  validity:  not before Mar 31 09:14:01 2012, ok
             not after  Apr 30 09:14:01 2012, ok (expires in 28 days)
  pubkey:    RSA 1024 bits, has private key
  keyid:     82:8e:cf:f7:a0:81:9e:00:77:0b:
d7:ee:6f:f7:43:8a:d2:73:e4:af
  subjkey:   5f:ed:01:a0:a6:18:fd:12:dd:18:e1:fe:d4:76:a2:ea:4c:8f:e2:74

List of X.509 CA Certificates:

  subject:  "C=de, ST=Bayern, L=Munich, O=Nokia Siemens Networks, OU=RTP,
CN=www.nokiasiemensnetworks.com, E=gianluigi.ongaro at nsn.com"
  issuer:   "C=de, ST=Bayern, L=Munich, O=Nokia Siemens Networks, OU=RTP,
CN=www.nokiasiemensnetworks.com, E=gianluigi.ongaro at nsn.com"
  serial:    00:a9:d9:3d:5e:b8:7b:a3:4d
  validity:  not before Mar 31 09:14:01 2012, ok
             not after  Apr 30 09:14:01 2012, ok (expires in 28 days)
  pubkey:    RSA 1024 bits
  keyid:     b0:de:5e:b4:0d:d3:1c:4d:25:e7:cf:4c:bc:f3:31:d1:47:03:1e:d5
  subjkey:   29:95:a1:57:17:5e:2b:7a:e0:9d:6d:56:f6:bf:5d:c8:41:1f:44:6f
  authkey:   29:95:a1:57:17:5e:2b:7a:e0:9d:6d:56:f6:bf:5d:c8:41:1f:44:6f


On Mon, Apr 2, 2012 at 3:48 PM, Andreas Steffen <
andreas.steffen at strongswan.org> wrote:

> Hi Reshma,
>
> by default the certificate's subjectDistinguishedName is used as
> an ID. There is no mechanism to automatically assign subjectAltNames.
>
> What should we do if several subjectAltNames exist?
>
> Regards
>
> Andreas
>
> On 02.04.2012 11:14, Reshma Begam wrote:
> > Hi Andreas,
> >
> >  Thanks for the response and this works.
> >
> > Also, how can we assign identity info from cert files to  leftid/rightid
> > ?  instead of explicitly defining them.
> >
> > Example:  I am looking something like leftid=%fromcert
> >
> > leftid=%fromcert and leftid=%leftcert -->  I tried both these options on
> > responder side instead of   leftid=cla.atca.nsn.com
> > <http://cla.atca.nsn.com/>, but it doesn't work.
> >
> > Could you please comment what should be the wild card entries on both
> > sides to acheive this assignments using certs?
> >
> > Thanks,
> > Reshma
> >
>
> ======================================================================
> Andreas Steffen                         andreas.steffen at strongswan.org
> strongSwan - the Linux VPN Solution!                www.strongswan.org
> Institute for Internet Technologies and Applications
> University of Applied Sciences Rapperswil
> CH-8640 Rapperswil (Switzerland)
> ===========================================================[ITA-HSR]==
>
>


-- 

Regards,
Reshma
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.strongswan.org/pipermail/users/attachments/20120403/4a4d2cee/attachment.html>