[strongSwan] IKE_SA getting established even without CA cert being present
andreas.steffen at strongswan.org
Mon Jun 18 09:01:41 CEST 2012
each endpoint loads its own certificate with
from a local file and has explicit trust in it
even if the CA certificate is not present. Since
the peer uses the identical defaultCertificate,
trust is also put into the peer.
You need a CA only if your peer has a certificate
different from the defaultCertificate.
On 18.06.2012 07:08, divya mohan wrote:
> I have set up an IPsec connection using certificates. I have copied
> the End Entity certificate and key; but I have not copied the CA
> I was expecting the connection to fail, as authentication should fail
> in this case. However, the connection seems to be working fine.
> I am attaching logs and ipsec.conf from Host1(initiator) and Host2(responder).
> Is this because of any issue in my configuration? Shouldn't
> authentication fail if issuer certificate is not found?
> Divya Mohan M
Andreas Steffen andreas.steffen at strongswan.org
strongSwan - the Linux VPN Solution! www.strongswan.org
Institute for Internet Technologies and Applications
University of Applied Sciences Rapperswil
CH-8640 Rapperswil (Switzerland)
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 4489 bytes
Desc: S/MIME Cryptographic Signature
More information about the Users