[strongSwan] IPsec PKI Tool

[Andreas Steffen]

Hello Chris,

I'm not sure about the ipsec pki release in strongSwan 4.4
but the current pki command can add one or several EKUs and
an arbitrary number of subjectAltNames:

http://wiki.strongswan.org/projects/strongswan/wiki/IpsecPkiIssue

EKUs:

   ipsec pki --issue --flag serverAuth
                     --flag clientAuth
                     --flag crlSign
                     --flag ocspSigning

subjectAltNames:

   ipsec pki --issue --san carol at strongswan.org
                     --san moon.strongswan.org
                     --san 11.22.33.44
                     --san 2001:3f54::5

Regards

Andreas

On 05/17/2012 05:00 PM, Chris Arnold wrote:
> strongSwan 4.4 on SLES11 SP2. Trying to get ikev2 roadwarriors config
> setup. I am following
> http://wiki.strongswan.org/projects/strongswan/wiki/Windows7 and
> trying to meet cert requirements:
> http://wiki.strongswan.org/projects/strongswan/wiki/Win7CertReq
>
> The EKU and subjectAltName, can this be done with the ipsec pki? I
> really cant take the time to learn openSSL right now (i know
> eventually i will have to but cant right now). Is it possible to put
> the EKU and subjectAltName in a cert with ipsec pki?
>

======================================================================
Andreas Steffen                         andreas.steffen at strongswan.org
strongSwan - the Linux VPN Solution!                www.strongswan.org
Institute for Internet Technologies and Applications
University of Applied Sciences Rapperswil
CH-8640 Rapperswil (Switzerland)
===========================================================[ITA-HSR]==