[strongSwan] how to use 'rightca' connection option?
jb20141125 at gmail.com
Wed Nov 23 16:41:50 CET 2016
I'm using Linux strongSwan U5.2.1/K3.4.112 and I'm trying to implement
rightca option in ipsec.conf file but without a success.
As far as I understand the documentation, if rightca contains DN of a
certificate authority which lies in the trust path from the end device cert
to rootca, authentication process will pass (assuming that other elements
are configured fine) otherwise will fail and this is the functionality I
need. But in my scenario, whatever is the value of rightca, the
authentication process pass with success.
I've put rightca on the initiator of IKEv2 tunnel, root ca chain path
lenght is 2 (root ca->sub1->sub2->end device cert). Currently only root ca
is installed in /etc/ipsec.d/cacerts.
Part of the connection config:
rightid="CN=*, ST=Stttt, C=Cccc, E=E at eeee, O=Oooooo, L=Lllllll,
rightca="CN=aa, ST=aa, C=aa, E=aa, O=aa, L=aa, OU=aa, OU=aa"
I've changed values of fields in righid, but rightca is taken from real
config without modification.
I'm probably missing something obvious, or does not understand this
feature, but I have no idea, what this can be.
Does anybody knows?
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Users