denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Save both base and delta CRLs to disk

Browse Source
This commit is contained in:
Andreas Steffen
2016-10-11 17:18:22 +02:00
parent 2a2669ee3e
commit 85b5a6ace2
8 changed files with 73 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/swanctl/crl-to-cache/description.txt
+8 -6
View File
@@ -1,6 +1,8 @@
By setting <b>cachecrls=yes</b> in ipsec.conf, a copy of the CRL fetched
via http from the web server <b>winnetou</b> is saved locally in the
directory <b>/etc/ipsec.d/crls</b> on both the roadwarrior <b>carol</b>
and the gateway <b>moon</b> when the IPsec connection is set up. The
<b>subjectKeyIdentifier</b> of the issuing CA plus the suffix <b>.crl</b>
is used as a unique filename for the cached CRL.
By setting <b>cache_crls = yes</b> in <b>/etc/strongswan.conf</b>, a copy of
both the <b>base CRL</b> and the latest <b>delta CRL</b> fetched via http from
the web server <b>winnetou</b> is saved locally in the directory
<b>/etc/swanctl/x509crl</b> on both the roadwarrior <b>carol</b> and the
gateway <b>moon</b> when the IPsec connection is set up.
The <b>subjectKeyIdentifier</b> of the issuing CA plus the suffixes
<b>.crl</b> and <b>_delta.crl</b> are used as unique filename for the
cached <b>base CRL</b> and <b>delta CRL</b>, respectively.