denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

credential-manager: Add option to reject trusted end-entity certificates

Browse Source 
This allows preventing peers from authenticating with certificates
that are locally trusted, in particular, our own local certificate (which
safeguards against accidental reuse of certificates on multiple peers).

On the other hand, if this option is enabled, end-entity certificates
for peers can't be configured anymore explicitly (e.g. via remote.certs
in swanctl.conf).
This commit is contained in:
Tobias Brunner
2023-11-13 12:01:41 +01:00
parent 28ccdff692
commit 04c17ab56a
2 changed files with 17 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
conf/options/charon.opt
+4
View File
@@ -372,6 +372,10 @@ charon.receive_delay_request = yes
charon.receive_delay_type = 0
Specific IKEv2 message type to delay, 0 for any.
charon.reject_trusted_end_entity = no
Reject peers that use trusted end-entity certificates (i.e. local
certificates).
charon.replay_window = 32
Size of the AH/ESP replay window, in packets.