Hi Anthony, > ? is this true, that the StrongSwan does not check the peer certificate KU and EKU during the initial IPsec VPN connection It's as I wrote in my previous mail. Regards, Tobias