Done, so I answer to myself. rmnet at mailc.net wrote: > But I get an AUTHENTICATION_FAILED notify error. Changing left id from > leftid="C=**, ST=**, L=***, O=***, OU=***, CN=***, E=***" to a very simple level leftid=CN-part (e.g. leftid=abc.xxx.ch) solved the problem (it was additionally necessary to set <rightid>). René