testing: Script building fresh certificates

2019-05-08 14:56:48 +02:00
parent 3ee352a691
commit 8db01c6a3f
164 changed files with 2064 additions and 690 deletions
@@ -6,11 +6,11 @@ AddHandler cgi-script .cgi

 <VirtualHost *:8880>
    ServerAdmin  [email protected]
-    DocumentRoot /etc/openssl/ocsp
+    DocumentRoot /etc/ca/ocsp
    ServerName   ocsp.strongswan.org
    ServerAlias	 192.168.0.150
    DirectoryIndex ocsp.cgi
-    <Directory "/etc/openssl/ocsp">
+    <Directory "/etc/ca/ocsp">
        Options  +ExecCGI
        Require all granted
   </Directory>
@@ -22,11 +22,11 @@ Listen 8881

 <VirtualHost *:8881>
    ServerAdmin  [email protected]
-    DocumentRoot /etc/openssl/research/ocsp
+    DocumentRoot /etc/ca/research/ocsp
    ServerName   ocsp.research.strongswan.org
    ServerAlias	 ocsp.strongswan.org 192.168.0.150
    DirectoryIndex ocsp.cgi
-    <Directory "/etc/openssl/research/ocsp">
+    <Directory "/etc/ca/research/ocsp">
        Options +ExecCGI
        Require all granted
   </Directory>
@@ -38,11 +38,11 @@ Listen 8882

 <VirtualHost *:8882>
    ServerAdmin  [email protected]
-    DocumentRoot /etc/openssl/sales/ocsp
+    DocumentRoot /etc/ca/sales/ocsp
    ServerName   ocsp.sales.strongswan.org
    ServerAlias	 ocsp.strongswan.org 192.168.0.150
    DirectoryIndex ocsp.cgi
-    <Directory "/etc/openssl/sales/ocsp">
+    <Directory "/etc/ca/sales/ocsp">
        Options +ExecCGI
        Require all granted
   </Directory>
@@ -0,0 +1,133 @@
+#!/bin/bash
+
+export LEAK_DETECTIVE_DISABLE=1
+
+ROOT="/var/www"
+
+##
+# strongSwan Root CA
+cd /etc/ca
+
+# copy strongsSwan CA certificate
+cp strongswanCert.pem ${ROOT}
+cp strongswanCert.der ${ROOT}
+
+# generate CRL for strongSwan Root CA
+pki --signcrl --cakey strongswanKey.pem --cacert strongswanCert.pem \
+    --lastcrl strongswan.crl > ${ROOT}/strongswan.crl
+
+# revoke moon's current certificate
+pki --signcrl --cakey strongswanKey.pem --cacert strongswanCert.pem \
+    --reason key-compromise --serial 03 \
+    --lastcrl ${ROOT}/strongswan.crl > ${ROOT}/strongswan_moon_revoked.crl
+
+# generate a base CRL
+pki --signcrl --cakey strongswanKey.pem --cacert strongswanCert.pem \
+    --crluri http://crl.strongswan.org/strongswan_delta.crl \
+    --lastcrl strongswan.crl --lifetime 30 > ${ROOT}/strongswan_base.crl
+
+# generate a delta CRL revoking moon's current cert
+pki --signcrl --cakey strongswanKey.pem --cacert strongswanCert.pem \
+    --basecrl ${ROOT}/strongswan_base.crl --reason key-compromise \
+    --serial 03 --lifetime 15 > ${ROOT}/strongswan_delta.crl
+
+# generate Hash-and-URL certificates
+CERTS_DIR="${ROOT}/certs"
+for cert in `ls certs`
+do
+  openssl x509 -in certs/${cert} -outform der -out ${CERTS_DIR}/cert.der
+  mv ${CERTS_DIR}/cert.der ${CERTS_DIR}/`sha1sum ${CERTS_DIR}/cert.der | head -c 40`
+done
+
+##
+# Research CA
+cd /etc/ca/research
+
+# copy Research CA certificate
+cp researchCert.pem ${ROOT}
+cp researchCert.der ${ROOT}
+
+# generate CRL for Research CA
+pki --signcrl --cakey researchKey.pem --cacert researchCert.pem \
+    > ${ROOT}/research.crl
+
+# generate Hash-and-URL certificates
+CERTS_DIR="${ROOT}/certs/research"
+for cert in `ls certs`
+do
+  openssl x509 -in certs/${cert} -outform der -out ${CERTS_DIR}/cert.der
+  mv ${CERTS_DIR}/cert.der ${CERTS_DIR}/`sha1sum ${CERTS_DIR}/cert.der | head -c 40`
+done
+
+##
+# Sales CA
+cd /etc/ca/sales
+
+# copy Sales CA certificate
+cp salesCert.pem ${ROOT}
+cp salesCert.der ${ROOT}
+
+# generate CRL for Sales CA
+pki --signcrl --cakey salesKey.pem --cacert salesCert.pem \
+    > ${ROOT}/sales.crl
+
+# generate Hash-and-URL certificates
+CERTS_DIR="${ROOT}/certs/sales"
+for cert in `ls certs`
+do
+  openssl x509 -in certs/${cert} -outform der -out ${CERTS_DIR}/cert.der
+  mv ${CERTS_DIR}/cert.der ${CERTS_DIR}/`sha1sum ${CERTS_DIR}/cert.der | head -c 40`
+done
+
+##
+# strongSwan EC Root CA
+cd /etc/ca/ecdsa
+
+# copy ECDSA CA certificate
+cp strongswanCert.pem ${ROOT}/strongswan_ecdsaCert.pem
+openssl ec -in strongswanKey.pem -outform der -out ${ROOT}/strongswan_ecdsaCert.der
+chmod a+r ${ROOT}/strongswan_ecdsaCert.der
+
+# generate CRL for strongSwan EC Root CA
+pki --signcrl --cakey strongswanKey.pem --cacert strongswanCert.pem \
+    > ${ROOT}/strongswan_ecdsa.crl
+
+##
+# strongSwan RFC3779 Root CA
+cd /etc/ca/rfc3779
+
+# generate CRL for strongSwan RFC3779 Root CA
+pki --signcrl --cakey strongswanKey.pem --cacert strongswanCert.pem \
+    > ${ROOT}/strongswan_rfc3779.crl
+
+##
+# strongSwan SHA3-RSA Root CA
+cd /etc/ca/sha3-rsa
+
+# generate CRL for strongSwan SHA3-RSA Root CA
+pki --signcrl --cakey strongswanKey.pem --cacert strongswanCert.pem \
+    --digest sha3_256 > ${ROOT}/strongswan_sha3_rsa.crl
+
+##
+# strongSwan Ed25519 Root CA
+cd /etc/ca/ed25519
+
+# generate CRL for strongSwan Ed25519 Root CA
+pki --signcrl --cakey strongswanKey.pem --cacert strongswanCert.pem \
+    > ${ROOT}/strongswan_ed25519.crl
+
+##
+# strongSwan Monster Root CA
+cd /etc/ca/monster
+
+# generate CRL for strongSwan Monster Root CA
+pki --signcrl --cakey strongswanKey.pem --cacert strongswanCert.pem \
+    > ${ROOT}/strongswan_monster.crl
+
+##
+# strongSwan BlISS Root CA
+cd /etc/ca/bliss
+
+# generate CRL for strongSwan BLISS Root CA
+pki --signcrl --cakey strongswan_blissKey.der --cacert strongswan_blissCert.der \
+    --lifetime 30 --digest sha3_512 > ${ROOT}/strongswan_bliss.crl
@@ -0,0 +1,58 @@
+<html>
+<head>
+  <title>strongSwan Web Services</title>
+  <base target="_self">
+</head>
+
+<body bgcolor="#FFFFFF">
+<table border=0 cellpadding=0 cellspacing=0 width=600>
+
+<tr><td>
+  <h2>strongSwan Testing Environment</h2>
+  <ul>
+    <li>
+      <a href="testresults/">Test Results</a>
+    </li>
+  </ul>
+  <a href="images/umlArchitecture_large.png" target="_blank">
+    <img src="images/umlArchitecture_small.png" border="0">
+  </a>
+
+    <h2>strongSwan Certification Authorities</h2>
+  <ul>
+    <li>
+      <bold>Root CA: </bold>
+      <a href="strongswanCert.pem">PEM</a> ,
+      <a href="strongswanCert.der">DER</a> ,
+      <a href="strongswan.crl">CRL</a>
+    </li>
+  </ul>
+  <ul>
+    <li>
+      <bold>Research CA: </bold>
+      <a href="researchCert.pem">PEM</a> ,
+      <a href="researchCert.der">DER</a> ,
+      <a href="research.crl">CRL</a>
+    </li>
+  </ul>
+  <ul>
+    <li>
+      <bold>Sales CA: </bold>
+       <a href="salesCert.pem">PEM</a> ,
+      <a href="salesCert.der">DER</a> ,
+      <a href="sales.crl">CRL</a>
+    </li>
+  </ul>
+  <ul>
+    <li>
+      <bold>ECDSA CA: </bold>
+      <a href="strongswan_ecdsaCert.pem">PEM</a> ,
+      <a href="strongswan_ecdsaCert.der">DER</a> ,
+     <a href="strongswan_ecdsa.crl">CRL</a>
+    </li>
+  </ul>
+  <hr>
+  <address>The strongSwan Project (<a href="https://www.strongswan.org">www.strongswan.org</a>)</address>
+</td></tr>
+</table>
+</body>
@@ -0,0 +1,22 @@
+V	EE_EXPIRATION		01	unknown	/C=CH/O=strongSwan Project/OU=Research/[email protected]
+V	EE_EXPIRATION		02	unknown	/C=CH/O=strongSwan Project/OU=Accounting/[email protected]
+V	EE_EXPIRATION		03	unknown	/C=CH/O=strongSwan Project/CN=moon.strongswan.org
+V	EE_EXPIRATION		04	unknown	/C=CH/O=strongSwan Project/CN=sun.strongswan.org
+V	EE_EXPIRATION		05	unknown	/C=CH/O=strongSwan Project/OU=Sales/[email protected]
+V	EE_EXPIRATION		06	unknown	/C=CH/O=strongSwan Project/CN=venus.strongswan.org
+V	EE_EXPIRATION		07	unknown	/C=CH/O=strongSwan Project/OU=Research/[email protected]
+R	EE_EXPIRATION	REVOCATION,keyCompromise	08	unknown	/C=CH/O=strongSwan Project/OU=Research/[email protected]
+V	EE_EXPIRATION		09	unknown	/C=CH/O=strongSwan Project/OU=Research/serialNumber=002/[email protected]
+R	IM_EXPIRATION	REVOCATION,CACompromise	0A	unknown	/C=CH/O=strongSwan Project/OU=Research/CN=Research CA
+V	IM_EXPIRATION		0B	unknown	/C=CH/O=strongSwan Project/OU=Research/CN=Research CA
+V	IM_EXPIRATION		0C	unknown	/C=CH/O=strongSwan Project/OU=Sales/CN=Sales CA
+V	EE_EXPIRATION		0D	unknown	/C=CH/O=strongSwan Project/OU=SHA-224/CN=moon.strongswan.org
+V	EE_EXPIRATION		0E	unknown	/C=CH/O=strongSwan Project/OU=SHA-384/[email protected]
+V	EE_EXPIRATION		0F	unknown	/C=CH/O=strongSwan Project/OU=SHA-512/[email protected]
+V	EE_EXPIRATION		10	unknown	/C=CH/O=strongSwan Project/OU=OCSP/[email protected]
+V	EE_EXPIRATION		11	unknown	/C=CH/O=strongSwan Project/OU=OCSP Signing Authority/CN=ocsp.strongswan.org
+V	EE_EXPIRATION		12	unknown	/C=CH/O=strongSwan Project/OU=Virtual VPN Gateway/CN=mars.strongswan.org
+V	EE_EXPIRATION		13	unknown	/C=CH/O=strongSwan Project/CN=winnetou.strongswan.org
+V	EE_EXPIRATION		14	unknown	/C=CH/O=strongSwan Project/CN=aaa.strongswan.org
+V	IM_EXPIRATION		15	unknown	/C=CH/O=strongSwan Project/CN=strongSwan Attribute Authority
+V	SH_EXPIRATION		16	unknown	/C=CH/O=strongSwan Project/CN=strongSwan Legacy AA
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+cd /etc/ca
+
+echo "Content-type: application/ocsp-response"
+echo ""
+
+cat | /usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \
+	-rkey ocspKey.pem -rsigner ocspCert.pem \
+	-nmin 5 \
+	-reqin /dev/stdin -respout /dev/stdout | cat
@@ -0,0 +1,4 @@
+V	EE_EXPIRATION		01	unknown	/C=CH/O=strongSwan Project/OU=Research/[email protected]
+V	EE_EXPIRATION		02	unknown	/C=CH/O=strongSwan Project/OU=Research OCSP Signing Authority/CN=ocsp.research.strongswan.org
+V	EE_EXPIRATION		03	unknown	/C=CH/O=strongSwan Project/OU=Sales/CN=Sales CA
+V	EE_EXPIRATION		04	unknown	/C=CH/O=strongSwan Project/OU=Research/CN=Duck Research CA
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+cd /etc/ca/research
+
+echo "Content-type: application/ocsp-response"
+echo ""
+
+cat | /usr/bin/openssl ocsp -index index.txt -CA researchCert.pem \
+	-rkey ocspKey.pem -rsigner ocspCert.pem \
+	-nmin 5 \
+	-reqin /dev/stdin -respout /dev/stdout | cat
@@ -0,0 +1,3 @@
+V	EE_EXPIRATION		01	unknown	/C=CH/O=strongSwan Project/OU=Sales/[email protected]
+V	EE_EXPIRATION		02	unknown	/C=CH/O=strongSwan Project/OU=Sales OCSP Signing Authority/CN=ocsp.sales.strongswan.org
+V	EE_EXPIRATION		03	unknown	/C=CH/O=strongSwan Project/OU=Research/CN=Research CA
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+cd /etc/ca/sales
+
+echo "Content-type: application/ocsp-response"
+echo ""
+
+cat | /usr/bin/openssl ocsp -index index.txt -CA salesCert.pem \
+	-rkey ocspKey.pem -rsigner ocspCert.pem \
+	-nmin 5 \
+	-reqin /dev/stdin -respout /dev/stdout | cat
@@ -1,39 +1,39 @@
-dn: o=Linux strongSwan, c=CH
+dn: o=strongSwan Project, c=CH
 objectclass: organization
-o: Linux strongSwan
+o: strongSwan Project

-dn: cn=Manager,o=Linux strongSwan, c=CH
+dn: cn=Manager,o=strongSwan Project, c=CH
 objectclass: organizationalRole
 cn: Manager

-dn: cn=strongSwan Root CA, o=Linux strongSwan, c=CH
+dn: cn=strongSwan Root CA, o=strongSwan Project, c=CH
 objectClass: organizationalRole
 cn: strongSwan Root CA
 objectClass: certificationAuthority
-authorityRevocationList;binary:< file:///etc/openssl/strongswan.crl
-certificateRevocationList;binary:< file:///etc/openssl/strongswan.crl
-cACertificate;binary:< file:///etc/openssl/strongswanCert.der
+authorityRevocationList;binary:< file:///var/www/strongswan.crl
+certificateRevocationList;binary:< file:///var/www/strongswan.crl
+cACertificate;binary:< file:///var/www/strongswanCert.der

-dn: ou=Research, o=Linux strongSwan, c=CH
+dn: ou=Research, o=strongSwan Project, c=CH
 objectclass: organizationalUnit
 ou: Research

-dn: cn=Research CA, ou=Research, o=Linux strongSwan, c=CH
+dn: cn=Research CA, ou=Research, o=strongSwan Project, c=CH
 objectClass: organizationalRole
 cn: Research CA
 objectClass: certificationAuthority
-authorityRevocationList;binary:< file:///etc/openssl/research/research.crl
-certificateRevocationList;binary:< file:///etc/openssl/research/research.crl
-cACertificate;binary:< file:///etc/openssl/research/researchCert.der
+authorityRevocationList;binary:< file:///var/www/research.crl
+certificateRevocationList;binary:< file:///var/www/research.crl
+cACertificate;binary:< file:///var/www/researchCert.der

-dn: ou=Sales, o=Linux strongSwan, c=CH
+dn: ou=Sales, o=strongSwan Project, c=CH
 objectclass: organizationalUnit
 ou: Sales

-dn: cn=Sales CA, ou=Sales, o=Linux strongSwan, c=CH
+dn: cn=Sales CA, ou=Sales, o=strongSwan Project, c=CH
 objectClass: organizationalRole
 cn: Sales CA
 objectClass: certificationAuthority
-authorityRevocationList;binary:< file:///etc/openssl/sales/sales.crl
-certificateRevocationList;binary:< file:///etc/openssl/sales/sales.crl
-cACertificate;binary:< file:///etc/openssl/sales/salesCert.der
+authorityRevocationList;binary:< file:///var/www/sales.crl
+certificateRevocationList;binary:< file:///var/www/sales.crl
+cACertificate;binary:< file:///var/www/salesCert.der
@@ -15,8 +15,8 @@ argsfile	/var/run/openldap/slapd.args
 #######################################################################

 database	bdb
-suffix		"o=Linux strongSwan,c=CH"
-rootdn		"cn=Manager,o=Linux strongSwan,c=CH"
+suffix		"o=strongSwan Project,c=CH"
+rootdn		"cn=Manager,o=strongSwan Project,c=CH"
 checkpoint	32	30
 rootpw		tuxmux
 directory	/var/lib/ldap
@@ -1,36 +0,0 @@
-<html>
-<head>
-  <title>strongSwan Web Services</title>
-  <base target="_self">
-</head>
-
-<body bgcolor="#FFFFFF">
-<table border=0 cellpadding=0 cellspacing=0 width=600>
-
-<tr><td>
-  <h2>strongSwan Certification Authority</h2>
-  <ul>
-    <li>
-      <a href="strongswanCert.pem">Root CA Certificate</a>
-    </li>
-  </ul>
-  <ul>
-    <li>
-      <a href="strongswan.crl">Certificate Revocation List (CRL)</a>
-    </li>
-  </ul>
-
-  <h2>strongSwan Testing Environment</h2>
-  <ul>
-    <li>
-      <a href="testresults/">Test Results</a>
-    </li>
-  </ul>
-  <a href="images/umlArchitecture_large.png" target="_blank">
-    <img src="images/umlArchitecture_small.png" border="0">
-  </a>
-  <hr>
-  <address>Linux strongSwan (<a href="http://www.strongswan.org">www.strongswan.org</a>)</address>
-</td></tr>
-</table>
-</body>
@@ -1,5 +1,5 @@
 # strongswan.conf - strongSwan configuration file

 pki {
-  load = random pem sha1 sha2 sha3 pkcs1 pkcs8 pem gmp mgf1 bliss curve25519 x509
+  load = random pem sha1 sha2 sha3 pkcs1 pkcs8 pem gmp mgf1 bliss curve25519 x509 openssl
 }
@@ -65,8 +65,9 @@ do
 		echo "/testresults /var/www/testresults 9p trans=virtio,version=9p2000.L 0 0" >> $LOOPDIR/etc/fstab
 		execute_chroot "a2enmod -q cgid" 0
 		execute_chroot "a2enmod -q rewrite" 0
-		execute_chroot "ln -s /etc/openssl/certs /var/www/certs" 0
-		execute_chroot "/etc/openssl/generate-crl" 0
+		execute_chroot "mkdir /var/www/certs" 0
+		execute_chroot "mkdir /var/www/certs/research /var/www/certs/sales" 0
+		execute_chroot "/etc/ca/generate-crl" 0
 		execute_chroot "rm -rf /var/lib/ldap/*" 0
 		execute_chroot "slapadd -l /etc/ldap/ldif.txt -f /etc/ldap/slapd.conf" 0
 		execute_chroot "chown -R openldap:openldap /var/lib/ldap" 0
@@ -1,30 +0,0 @@
-----BEGIN RSA PRIVATE KEY-----
-Proc-Type: 4,ENCRYPTED
-DEK-Info: AES-128-CBC,7E1D40A7901772BA4D22AF58AA2DC76F
-
-1jt4EsxtHvgpSLN8PA/kSVKgoAsBEBQb8RK6VGnZywMCnpJdLKdPisGGYKNPg53b
-/0AFBmQVE60M8icbSAIUrAtyKxaBkoc9A7ibNCjobi0UzXTm3GcZZ1EC4/lE9PQZ
-/2FbcPgQWN3kZraZDkeP9XBXl6PorES8xvQUxJ9pd4hL7/c28fIApGhEimkIZO8o
-Qb7bR2cNCLYQAR6PeDoqhV39gvWoh77wp1WB3tQVbkS6MI/xl3wY2QVdq3Sbszh+
-f6lDU/SZS8BU0f44FRoInPp0GasgJ7MCiuEIshjuNPa50QkMcnNJsSgVEuw2hjN6
-LvAXx7vPt9pKpQfnu7YSJUsXDYN6PyXt7sZ8hDqraYIcI6eMpEBaTpItPSV2eckv
-06KC24Oa66E1yufNFAY49S2OY+pJA0W5zmcCqCjdrfJ+wNQYKZpbrfGz4VRzlFJC
-e3VkmAFwA5rcZdlp/mU2XREy+TaWsHMnpL0NcMHGmsfkTgaJIkRWalrdxlNTeitr
-3boNHWk0ESyMcBYRpM3eNXsGpiYy93u0bhrPbnqJsV6miKqpbs1aBNjlJ9s1Y2fC
-sko5/v7uMjb5tLF3lWQZfTu+bYtpGxFrqHJjhd8yd4gL1cFi30JcjczhwRY3Dily
-c0BFekMGmPc1djn6tfIFu13X9xTxyidCpVaT9UGnOaQs9OF1u8XAnZDaQgPwjLiy
-UlOE8xQ60LrhWLD582FsFnZz56bZ+QOQRWDMsB8nJeqnFXKfcRlnr0qlG6lTfA8h
-XkK/qGpdVvivS+CpbhVP6ixdEfa91Rx4NjLj53LGqOYwFEkM/OAIuMJetBfx3v9T
-iQfv594KE32nv9besnKlmJr2cGQWBYg1pUOtFj/aZ00yuXacv8qwzbrt4xGGDYGO
-Aj5Yf93UEcVkTySO1xJ1yiC6GJv1lLm0i5StwykHypxFijKe/zOpgtHVa5v5igjO
-v6cfhfJGGgIPTYrtt+EDKXcayvy2e2U/3HYVCHYiiMPX8AvP/R6m7MGrzYxm/WyO
-t68EWXSDLfuR3qcIlpP4aSBxuSpKhY/dIkS/beKZ7Njx1s4jSuYDMbKuuCRFSU2H
-8ISHS0kh3FetiS8IyIYzxab+KQZwnVtiGj4oaAhgFTIIoH26Fv5+xka74JdzOSUA
-jR9puKuxaegVWQVBx4cCyg6hAdewRm64PAcbApZWrPvMPBfTZFnXeifmaurcdK8p
-p/1eLrrPnNM6+Fh6lcKdX74yHPz3eWP3K1njZegzWnChhEWElPhJr6qYNQjd+lAS
-7650RJ3CJLUxBffnRR9nTArxFNI5jGWg/plLJTaRT5x5qg1dGNMqntpoeiY++Ttk
-GFDGVIOICBze6SOvzkZBbuXLJSWmWj5g9J2cYsLoOvlwsDT7FzKl8p6VY4V+SQb+
-4PN8qZWmOeczaLEhZ1QLmTKFpz9+wUZsXeBd1s78bWJR0zhraMPa0UJ9GBGq6uQ0
-yZ4Xm5KHKcgoewCUQMekU9ECsmR5NuC7VFDaa1OdPEVnEYR1xtaWUY0lYKOiixnd
-+85fSq/yAXI/r0O4ISA55o9y1kDqVibTwJacb6xXGg8dHSH+TtigwD8fK9mekkDC
-----END RSA PRIVATE KEY-----
@@ -1,30 +0,0 @@
-----BEGIN RSA PRIVATE KEY-----
-Proc-Type: 4,ENCRYPTED
-DEK-Info: AES-128-CBC,7E1D40A7901772BA4D22AF58AA2DC76F
-
-1jt4EsxtHvgpSLN8PA/kSVKgoAsBEBQb8RK6VGnZywMCnpJdLKdPisGGYKNPg53b
-/0AFBmQVE60M8icbSAIUrAtyKxaBkoc9A7ibNCjobi0UzXTm3GcZZ1EC4/lE9PQZ
-/2FbcPgQWN3kZraZDkeP9XBXl6PorES8xvQUxJ9pd4hL7/c28fIApGhEimkIZO8o
-Qb7bR2cNCLYQAR6PeDoqhV39gvWoh77wp1WB3tQVbkS6MI/xl3wY2QVdq3Sbszh+
-f6lDU/SZS8BU0f44FRoInPp0GasgJ7MCiuEIshjuNPa50QkMcnNJsSgVEuw2hjN6
-LvAXx7vPt9pKpQfnu7YSJUsXDYN6PyXt7sZ8hDqraYIcI6eMpEBaTpItPSV2eckv
-06KC24Oa66E1yufNFAY49S2OY+pJA0W5zmcCqCjdrfJ+wNQYKZpbrfGz4VRzlFJC
-e3VkmAFwA5rcZdlp/mU2XREy+TaWsHMnpL0NcMHGmsfkTgaJIkRWalrdxlNTeitr
-3boNHWk0ESyMcBYRpM3eNXsGpiYy93u0bhrPbnqJsV6miKqpbs1aBNjlJ9s1Y2fC
-sko5/v7uMjb5tLF3lWQZfTu+bYtpGxFrqHJjhd8yd4gL1cFi30JcjczhwRY3Dily
-c0BFekMGmPc1djn6tfIFu13X9xTxyidCpVaT9UGnOaQs9OF1u8XAnZDaQgPwjLiy
-UlOE8xQ60LrhWLD582FsFnZz56bZ+QOQRWDMsB8nJeqnFXKfcRlnr0qlG6lTfA8h
-XkK/qGpdVvivS+CpbhVP6ixdEfa91Rx4NjLj53LGqOYwFEkM/OAIuMJetBfx3v9T
-iQfv594KE32nv9besnKlmJr2cGQWBYg1pUOtFj/aZ00yuXacv8qwzbrt4xGGDYGO
-Aj5Yf93UEcVkTySO1xJ1yiC6GJv1lLm0i5StwykHypxFijKe/zOpgtHVa5v5igjO
-v6cfhfJGGgIPTYrtt+EDKXcayvy2e2U/3HYVCHYiiMPX8AvP/R6m7MGrzYxm/WyO
-t68EWXSDLfuR3qcIlpP4aSBxuSpKhY/dIkS/beKZ7Njx1s4jSuYDMbKuuCRFSU2H
-8ISHS0kh3FetiS8IyIYzxab+KQZwnVtiGj4oaAhgFTIIoH26Fv5+xka74JdzOSUA
-jR9puKuxaegVWQVBx4cCyg6hAdewRm64PAcbApZWrPvMPBfTZFnXeifmaurcdK8p
-p/1eLrrPnNM6+Fh6lcKdX74yHPz3eWP3K1njZegzWnChhEWElPhJr6qYNQjd+lAS
-7650RJ3CJLUxBffnRR9nTArxFNI5jGWg/plLJTaRT5x5qg1dGNMqntpoeiY++Ttk
-GFDGVIOICBze6SOvzkZBbuXLJSWmWj5g9J2cYsLoOvlwsDT7FzKl8p6VY4V+SQb+
-4PN8qZWmOeczaLEhZ1QLmTKFpz9+wUZsXeBd1s78bWJR0zhraMPa0UJ9GBGq6uQ0
-yZ4Xm5KHKcgoewCUQMekU9ECsmR5NuC7VFDaa1OdPEVnEYR1xtaWUY0lYKOiixnd
-+85fSq/yAXI/r0O4ISA55o9y1kDqVibTwJacb6xXGg8dHSH+TtigwD8fK9mekkDC
-----END RSA PRIVATE KEY-----
@@ -1,30 +0,0 @@
-----BEGIN RSA PRIVATE KEY-----
-Proc-Type: 4,ENCRYPTED
-DEK-Info: AES-128-CBC,7E1D40A7901772BA4D22AF58AA2DC76F
-
-1jt4EsxtHvgpSLN8PA/kSVKgoAsBEBQb8RK6VGnZywMCnpJdLKdPisGGYKNPg53b
-/0AFBmQVE60M8icbSAIUrAtyKxaBkoc9A7ibNCjobi0UzXTm3GcZZ1EC4/lE9PQZ
-/2FbcPgQWN3kZraZDkeP9XBXl6PorES8xvQUxJ9pd4hL7/c28fIApGhEimkIZO8o
-Qb7bR2cNCLYQAR6PeDoqhV39gvWoh77wp1WB3tQVbkS6MI/xl3wY2QVdq3Sbszh+
-f6lDU/SZS8BU0f44FRoInPp0GasgJ7MCiuEIshjuNPa50QkMcnNJsSgVEuw2hjN6
-LvAXx7vPt9pKpQfnu7YSJUsXDYN6PyXt7sZ8hDqraYIcI6eMpEBaTpItPSV2eckv
-06KC24Oa66E1yufNFAY49S2OY+pJA0W5zmcCqCjdrfJ+wNQYKZpbrfGz4VRzlFJC
-e3VkmAFwA5rcZdlp/mU2XREy+TaWsHMnpL0NcMHGmsfkTgaJIkRWalrdxlNTeitr
-3boNHWk0ESyMcBYRpM3eNXsGpiYy93u0bhrPbnqJsV6miKqpbs1aBNjlJ9s1Y2fC
-sko5/v7uMjb5tLF3lWQZfTu+bYtpGxFrqHJjhd8yd4gL1cFi30JcjczhwRY3Dily
-c0BFekMGmPc1djn6tfIFu13X9xTxyidCpVaT9UGnOaQs9OF1u8XAnZDaQgPwjLiy
-UlOE8xQ60LrhWLD582FsFnZz56bZ+QOQRWDMsB8nJeqnFXKfcRlnr0qlG6lTfA8h
-XkK/qGpdVvivS+CpbhVP6ixdEfa91Rx4NjLj53LGqOYwFEkM/OAIuMJetBfx3v9T
-iQfv594KE32nv9besnKlmJr2cGQWBYg1pUOtFj/aZ00yuXacv8qwzbrt4xGGDYGO
-Aj5Yf93UEcVkTySO1xJ1yiC6GJv1lLm0i5StwykHypxFijKe/zOpgtHVa5v5igjO
-v6cfhfJGGgIPTYrtt+EDKXcayvy2e2U/3HYVCHYiiMPX8AvP/R6m7MGrzYxm/WyO
-t68EWXSDLfuR3qcIlpP4aSBxuSpKhY/dIkS/beKZ7Njx1s4jSuYDMbKuuCRFSU2H
-8ISHS0kh3FetiS8IyIYzxab+KQZwnVtiGj4oaAhgFTIIoH26Fv5+xka74JdzOSUA
-jR9puKuxaegVWQVBx4cCyg6hAdewRm64PAcbApZWrPvMPBfTZFnXeifmaurcdK8p
-p/1eLrrPnNM6+Fh6lcKdX74yHPz3eWP3K1njZegzWnChhEWElPhJr6qYNQjd+lAS
-7650RJ3CJLUxBffnRR9nTArxFNI5jGWg/plLJTaRT5x5qg1dGNMqntpoeiY++Ttk
-GFDGVIOICBze6SOvzkZBbuXLJSWmWj5g9J2cYsLoOvlwsDT7FzKl8p6VY4V+SQb+
-4PN8qZWmOeczaLEhZ1QLmTKFpz9+wUZsXeBd1s78bWJR0zhraMPa0UJ9GBGq6uQ0
-yZ4Xm5KHKcgoewCUQMekU9ECsmR5NuC7VFDaa1OdPEVnEYR1xtaWUY0lYKOiixnd
-+85fSq/yAXI/r0O4ISA55o9y1kDqVibTwJacb6xXGg8dHSH+TtigwD8fK9mekkDC
-----END RSA PRIVATE KEY-----
@@ -16,6 +16,6 @@ conn alice
 	leftsendcert=ifasked
 	right=PH_IP_MOON
 	[email protected]
-	rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
+	rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"
 	rightsubnet=PH_IP_ALICE/32
 	auto=add
@@ -16,6 +16,6 @@ conn venus
 	leftsendcert=ifasked
 	right=PH_IP_MOON
 	[email protected]
-	rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
+	rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"
 	rightsubnet=PH_IP_VENUS/32
 	auto=add
@@ -22,12 +22,12 @@ conn alice
 	leftsubnet=PH_IP_ALICE/32
 	right=PH_IP_CAROL
 	[email protected]
-	rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
+	rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"
 	auto=add
-	
+
 conn venus
 	leftsubnet=PH_IP_VENUS/32
 	right=PH_IP_DAVE
 	[email protected]
-	rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
+	rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"
 	auto=add
@@ -13,7 +13,7 @@ conn %default
 	leftsendcert=ifasked
 	right=PH_IP_MOON
 	[email protected]
-	rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
+	rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"

 conn alice
 	rightsubnet=PH_IP_ALICE/32
@@ -13,7 +13,7 @@ conn %default
 	leftsendcert=ifasked
 	right=PH_IP_MOON
 	[email protected]
-	rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
+	rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"

 conn venus
 	rightsubnet=PH_IP_VENUS/32
@@ -21,11 +21,11 @@ conn %default
 conn alice
 	leftsubnet=PH_IP_ALICE/32
 	right=%any
-	rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
+	rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"
 	auto=add
-	
+
 conn venus
 	leftsubnet=PH_IP_VENUS/32
 	right=%any
-	rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
+	rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"
 	auto=add
@@ -13,12 +13,12 @@ conn %default
 	leftsendcert=ifasked
 	right=PH_IP_MOON
 	[email protected]
-	rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
+	rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"

 conn alice
 	rightsubnet=PH_IP_ALICE/32
 	auto=add
-	
+
 conn venus
 	rightsubnet=PH_IP_VENUS/32
 	auto=add
@@ -13,12 +13,12 @@ conn %default
 	leftsendcert=ifasked
 	right=PH_IP_MOON
 	[email protected]
-	rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
+	rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"

 conn alice
 	rightsubnet=PH_IP_ALICE/32
 	auto=add
-	
+
 conn venus
 	rightsubnet=PH_IP_VENUS/32
 	auto=add
@@ -21,11 +21,11 @@ conn %default
 conn alice
 	leftsubnet=PH_IP_ALICE/32
 	right=%any
-	rightca="C=CH, O=Linux strongSwan, OU=Research, CN=Research CA"
+	rightca="C=CH, O=strongSwan Project, OU=Research, CN=Research CA"
 	auto=add
-	
+
 conn venus
 	leftsubnet=PH_IP_VENUS/32
 	right=%any
-	rightca="C=CH, O=Linux strongSwan, OU=Sales, CN=Sales CA"
+	rightca="C=CH, O=strongSwan Project, OU=Sales, CN=Sales CA"
 	auto=add
@@ -7,5 +7,5 @@ dave::iptables-restore < /etc/iptables.flush
 moon::rm /etc/ipsec.d/acerts/carol-sales-finance.pem
 moon::rm /etc/ipsec.d/acerts/dave-sales-expired.pem
 moon::rm /etc/ipsec.d/acerts/dave-marketing.pem
-moon::rm /etc/ipsec.d/private/aa.pem
-moon::rm /etc/ipsec.d/aacerts/aa.pem
+moon::rm /etc/ipsec.d/private/aaKey.pem
+moon::rm /etc/ipsec.d/aacerts/aaCert.pem
@@ -1,23 +0,0 @@
-# Carols acert for sales and finance
-pki --acert \
-	--issuercert hosts/moon/etc/ipsec.d/aacerts/aa.pem \
-	--issuerkey hosts/moon/etc/ipsec.d/private/aa.pem \
-	--in ../../../hosts/carol/etc/ipsec.d/certs/carolCert.pem \
-	--group sales --group finance -l 87600 -f pem \
-	> hosts/moon/etc/ipsec.d/acerts/carol-sales-finance.pem
-
-# Daves acert for marketing
-pki --acert \
-	--issuercert hosts/moon/etc/ipsec.d/aacerts/aa.pem \
-	--issuerkey hosts/moon/etc/ipsec.d/private/aa.pem \
-	--in ../../../hosts/dave/etc/ipsec.d/certs/daveCert.pem \
-	--group marketing -l 87600 -f pem \
-	> hosts/moon/etc/ipsec.d/acerts/dave-marketing.pem
-
-# Daves expired acert for sales
-pki --acert \
-	--issuercert hosts/moon/etc/ipsec.d/aacerts/aa.pem \
-	--issuerkey hosts/moon/etc/ipsec.d/private/aa.pem \
-	--in ../../../hosts/dave/etc/ipsec.d/certs/daveCert.pem \
-	--group sales -F "01.01.13 08:00:00" -l 240 -f pem \
-	> hosts/moon/etc/ipsec.d/acerts/dave-sales-expired.pem
@@ -4,5 +4,5 @@ moon::iptables-restore < /etc/iptables.flush
 carol::iptables-restore < /etc/iptables.flush
 carol::rm /etc/ipsec.d/acerts/carol-sales.pem
 carol::rm /etc/ipsec.d/acerts/carol-finance-expired.pem
-moon::rm /etc/ipsec.d/private/aa.pem
-moon::rm /etc/ipsec.d/aacerts/aa.pem
+moon::rm /etc/ipsec.d/private/aaKey.pem
+moon::rm /etc/ipsec.d/aacerts/aaCert.pem
@@ -1,15 +0,0 @@
-# Carols expired acert for finance
-pki --acert \
-	--issuercert hosts/moon/etc/ipsec.d/aacerts/aa.pem \
-	--issuerkey hosts/moon/etc/ipsec.d/private/aa.pem \
-	--in ../../../hosts/carol/etc/ipsec.d/certs/carolCert.pem \
-	--group finance -F "01.01.13 08:00:00" -l 240 -f pem \
-	> ./hosts/carol/etc/ipsec.d/acerts/carol-finance-expired.pem
-
-# Carols valid acert for sales
-pki --acert \
-	--issuercert hosts/moon/etc/ipsec.d/aacerts/aa.pem \
-	--issuerkey hosts/moon/etc/ipsec.d/private/aa.pem \
-	--in ../../../hosts/carol/etc/ipsec.d/certs/carolCert.pem \
-	--group sales -l 87600 -f pem \
-	> hosts/carol/etc/ipsec.d/acerts/carol-sales.pem
@@ -3,9 +3,9 @@ dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*[email protected].*moon.s
 moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*[email protected]::YES
 moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*[email protected]::NO
 moon::cat /var/log/daemon.log::constraint check failed: group membership to 'sales' required::YES
-carol::cat /var/log/daemon.log::sending attribute certificate issued by \"C=CH, O=Linux strongSwan, CN=strongSwan AA\"::YES
-dave::cat /var/log/daemon.log::sending attribute certificate issued by \"C=CH, O=Linux strongSwan, CN=strongSwan AA\"::YES
-dave::cat /var/log/daemon.log::sending attribute certificate issued by \"C=CH, O=Linux strongSwan, CN=expired AA\"::YES
+carol::cat /var/log/daemon.log::sending attribute certificate issued by \"C=CH, O=strongSwan Project, CN=strongSwan Attribute Authority\"::YES
+dave::cat /var/log/daemon.log::sending attribute certificate issued by \"C=CH, O=strongSwan Project, CN=strongSwan Attribute Authority\"::YES
+dave::cat /var/log/daemon.log::sending attribute certificate issued by \"C=CH, O=strongSwan Project, CN=strongSwan Legacy AA\"::YES
 dave::cat /var/log/daemon.log::received AUTHENTICATION_FAILED notify error::YES
 carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
 dave:: ping -c 1 -W 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::NO
@@ -7,7 +7,7 @@ dave::iptables-restore < /etc/iptables.flush
 carol::rm /etc/ipsec.d/acerts/carol-sales.pem
 dave::rm /etc/ipsec.d/acerts/dave-expired-aa.pem
 dave::rm /etc/ipsec.d/acerts/dave-marketing.pem
-moon::rm /etc/ipsec.d/private/aa-expired.pem
-moon::rm /etc/ipsec.d/private/aa.pem
-moon::rm /etc/ipsec.d/aacerts/aa-expired.pem
-moon::rm /etc/ipsec.d/aacerts/aa.pem
+moon::rm /etc/ipsec.d/private/aaKey-expired.pem
+moon::rm /etc/ipsec.d/private/aaKey.pem
+moon::rm /etc/ipsec.d/aacerts/aaCert-expired.pem
+moon::rm /etc/ipsec.d/aacerts/aaCert.pem
@@ -1,23 +0,0 @@
-# Carols sales acert
-pki --acert \
-	--issuercert hosts/moon/etc/ipsec.d/aacerts/aa.pem \
-	--issuerkey hosts/moon/etc/ipsec.d/private/aa.pem --in \
-	../../../hosts/carol/etc/ipsec.d/certs/carolCert.pem \
-	--group sales -l 87600 -f pem \
-	> hosts/carol/etc/ipsec.d/acerts/carol-sales.pem
-
-# Daves marketing acert
-pki --acert \
-	--issuercert hosts/moon/etc/ipsec.d/aacerts/aa.pem \
-	--issuerkey hosts/moon/etc/ipsec.d/private/aa.pem \
-	--in ../../../hosts/dave/etc/ipsec.d/certs/daveCert.pem \
-	--group marketing -l 87600 -f pem
-	> hosts/dave/etc/ipsec.d/acerts/dave-marketing.pem
-
-# Daves sales acert from expired AA
-pki --acert \
-	--issuercert hosts/moon/etc/ipsec.d/aacerts/aa-expired.pem \
-	--issuerkey hosts/moon/etc/ipsec.d/private/aa-expired.pem \
-	--in ../../../hosts/dave/etc/ipsec.d/certs/daveCert.pem \
-	--group sales -l 87600 -f pem \
-	> hosts/dave/etc/ipsec.d/acerts/dave-expired-aa.pem
@@ -16,7 +16,7 @@ conn %default
 	left=%any
 	leftcert=bobCert.pem

-conn sun 
+conn sun
 	right=PH_IP_SUN1
-	rightid="C=CH, O=Linux strongSwan, CN=sun.strongswan.org"
+	rightid="C=CH, O=strongSwan Project, CN=sun.strongswan.org"
 	auto=route
@@ -18,10 +18,10 @@ conn %default

 conn alice
 	right=PH_IP_ALICE
-	rightid="C=CH, O=Linux strongSwan, OU=Sales, [email protected]"
+	rightid="C=CH, O=strongSwan Project, OU=Sales, [email protected]"
 	auto=route

-conn sun 
+conn sun
 	right=PH_IP_SUN
-	rightid="C=CH, O=Linux strongSwan, CN=sun.strongswan.org"
+	rightid="C=CH, O=strongSwan Project, CN=sun.strongswan.org"
 	auto=route
@@ -6,7 +6,7 @@ config setup

 ca strongswan
 	cacert=strongswanCert.pem
-	crluri="ldap://ldap.strongswan.org/cn=strongSwan Root CA, o=Linux strongSwan, c=CH?certificateRevocationList"
+	crluri="ldap://ldap.strongswan.org/cn=strongSwan Root CA, o=strongSwan Project, c=CH?certificateRevocationList"
 	auto=add

 conn %default
@@ -6,7 +6,7 @@ config setup

 ca strongswan
 	cacert=strongswanCert.pem
-	crluri="ldap://ldap.strongswan.org/cn=strongSwan Root CA, o=Linux strongSwan, c=CH?certificateRevocationList"
+	crluri="ldap://ldap.strongswan.org/cn=strongSwan Root CA, o=strongSwan Project, c=CH?certificateRevocationList"
 	auto=add

 conn %default
@@ -11,7 +11,7 @@ conn %default

 conn home
 	left=PH_IP_CAROL
-	leftcert=carolRevokedCert.pem
+	leftcert=carolCert.pem
 	[email protected]
 	right=PH_IP_MOON
 	rightsubnet=10.1.0.0/16
@@ -1,3 +1,3 @@
 # /etc/ipsec.secrets - strongSwan IPsec secrets file

-: RSA carolRevokedKey.pem
+: RSA carolKey.pem
@@ -1,4 +1,2 @@
 moon::ipsec stop
 carol::ipsec stop
-carol::rm /etc/ipsec.d/private/*
-carol::rm /etc/ipsec.d/certs/*
@@ -1,4 +1,4 @@
 moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*[email protected]::YES
 carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*[email protected].*moon.strongswan.org::YES
-moon:: cat /var/log/daemon.log::written crl .*/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl::YES
-carol::cat /var/log/daemon.log::written crl .*/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl::YES
+moon:: cat /var/log/daemon.log::written crl .*/etc/ipsec.d/crls/.*.crl::YES
+carol::cat /var/log/daemon.log::written crl .*/etc/ipsec.d/crls/.*.crl::YES
@@ -5,7 +5,7 @@ config setup

 ca strongswan
        cacert=strongswanCert.pem
-        crluri="ldap://ldap.strongswan.org/cn=strongSwan Root CA, o=Linux strongSwan, c=CH?certificateRevocationList"
+        crluri="ldap://ldap.strongswan.org/cn=strongSwan Root CA, o=strongSwan Project, c=CH?certificateRevocationList"
        auto=add

 conn %default
@@ -18,12 +18,12 @@ conn %default
 	leftcert=carolCert.pem
 	right=PH_IP_MOON
 	[email protected]
-	rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
+	rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"

 conn alice
 	rightsubnet=PH_IP_ALICE/32
 	auto=add
-	
+
 conn venus
 	rightsubnet=PH_IP_VENUS/32
 	auto=add
@@ -5,7 +5,7 @@ config setup

 ca strongswan
 	cacert=strongswanCert.pem
-	crluri="ldap://ldap.strongswan.org/cn=strongSwan Root CA, o=Linux strongSwan, c=CH?certificateRevocationList"
+	crluri="ldap://ldap.strongswan.org/cn=strongSwan Root CA, o=strongSwan Project, c=CH?certificateRevocationList"
 	auto=add

 conn %default
@@ -18,12 +18,12 @@ conn %default
 	leftcert=daveCert.pem
 	right=PH_IP_MOON
 	[email protected]
-	rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
+	rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"

 conn alice
 	rightsubnet=PH_IP_ALICE/32
 	auto=add
-	
+
 conn venus
 	rightsubnet=PH_IP_VENUS/32
 	auto=add
@@ -5,19 +5,19 @@ config setup

 ca strongswan
 	cacert=strongswanCert.pem
-	crluri="ldap://ldap.strongswan.org/cn=strongSwan Root CA, o=Linux strongSwan, c=CH?certificateRevocationList"
+	crluri="ldap://ldap.strongswan.org/cn=strongSwan Root CA, o=strongSwan Project, c=CH?certificateRevocationList"
 	auto=add

-ca research 
+ca research
        cacert=researchCert.pem
-	crluri="ldap://ldap.strongswan.org/cn=Research CA, ou=Research, o=Linux strongSwan, c=CH?certificateRevocationList"
+	crluri="ldap://ldap.strongswan.org/cn=Research CA, ou=Research, o=strongSwan Project, c=CH?certificateRevocationList"
 	auto=add
-	
-ca sales 
+
+ca sales
        cacert=salesCert.pem
-	crluri="ldap://ldap.strongswan.org/cn=Sales CA, ou=Sales, o=Linux strongSwan, c=CH?certificateRevocationList"
+	crluri="ldap://ldap.strongswan.org/cn=Sales CA, ou=Sales, o=strongSwan Project, c=CH?certificateRevocationList"
 	auto=add
-			
+
 conn %default
 	ikelifetime=60m
 	keylife=20m
@@ -32,11 +32,11 @@ conn %default
 conn alice
 	leftsubnet=PH_IP_ALICE/32
 	right=%any
-	rightca="C=CH, O=Linux strongSwan, OU=Research, CN=Research CA"
+	rightca="C=CH, O=strongSwan Project, OU=Research, CN=Research CA"
 	auto=add
-	
+
 conn venus
 	leftsubnet=PH_IP_VENUS/32
 	right=%any
-	rightca="C=CH, O=Linux strongSwan, OU=Sales, CN=Sales CA"
+	rightca="C=CH, O=strongSwan Project, OU=Sales, CN=Sales CA"
 	auto=add
@@ -17,5 +17,5 @@ conn home
 	right=PH_IP_MOON
 	rightsubnet=10.1.0.0/16
 	[email protected]
-	rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
+	rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"
 	auto=add
@@ -3,11 +3,6 @@
 config setup
 	strictcrlpolicy=yes

-ca strongswan
-	cacert=strongswanCert.pem
-	crluri=http://crl.strongswan.org/strongswan.crl
-	auto=add
-
 conn %default
 	ikelifetime=60m
 	keylife=20m
@@ -21,5 +16,5 @@ conn %default
 conn alice
 	leftsubnet=PH_IP_ALICE/32
 	right=%any
-	rightca="C=CH, O=Linux strongSwan, OU=Research, CN=Research CA"
+	rightca="C=CH, O=strongSwan Project, OU=Research, CN=Research CA"
 	auto=add
@@ -17,5 +17,5 @@ conn home
 	right=PH_IP_MOON
 	rightsubnet=10.1.0.0/16
 	[email protected]
-	rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
+	rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"
 	auto=add
@@ -3,11 +3,6 @@
 config setup
 	strictcrlpolicy=yes

-ca strongswan
-	cacert=strongswanCert.pem
-	crluri=http://crl.strongswan.org/not-available.crl
-	auto=add
-
 conn %default
 	ikelifetime=60m
 	keylife=20m
@@ -21,5 +16,5 @@ conn %default
 conn alice
 	leftsubnet=PH_IP_ALICE/32
 	right=%any
-	rightca="C=CH, O=Linux strongSwan, OU=Research, CN=Research CA"
+	rightca="C=CH, O=strongSwan Project, OU=Research, CN=Research CA"
 	auto=add
@@ -14,12 +14,12 @@ conn %default
 	leftsendcert=ifasked
 	right=PH_IP_MOON
 	[email protected]
-	rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
+	rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"

 conn alice
 	rightsubnet=PH_IP_ALICE/32
 	auto=add
-	
+
 conn venus
 	rightsubnet=PH_IP_VENUS/32
 	auto=add
@@ -14,12 +14,12 @@ conn %default
 	leftsendcert=ifasked
 	right=PH_IP_MOON
 	[email protected]
-	rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
+	rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"

 conn alice
 	rightsubnet=PH_IP_ALICE/32
 	auto=add
-	
+
 conn venus
 	rightsubnet=PH_IP_VENUS/32
 	auto=add
@@ -22,11 +22,11 @@ conn %default
 conn alice
 	leftsubnet=PH_IP_ALICE/32
 	right=%any
-	rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
+	rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"
 	auto=add
-	
+
 conn venus
 	leftsubnet=PH_IP_VENUS/32
 	right=%any
-	rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
+	rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"
 	auto=add
@@ -2,11 +2,6 @@

 config setup

-ca strongswan
-	cacert=strongswanCert.pem
-	crluri=http://crl.strongswan.org/strongswan.crl
-	auto=add
-
 conn %default
 	ikelifetime=60m
 	keylife=20m
@@ -21,11 +16,11 @@ conn %default
 conn alice
 	leftsubnet=PH_IP_ALICE/32
 	right=%any
-	rightca="C=CH, O=Linux strongSwan, OU=Research, CN=Research CA"
+	rightca="C=CH, O=strongSwan Project, OU=Research, CN=Research CA"
 	auto=add
-	
+
 conn venus
 	leftsubnet=PH_IP_VENUS/32
 	right=%any
-	rightca="C=CH, O=Linux strongSwan, OU=Sales, CN=Sales CA"
+	rightca="C=CH, O=strongSwan Project, OU=Sales, CN=Sales CA"
 	auto=add
@@ -3,5 +3,5 @@
 charon {
  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown

-  fragment_size = 1024
+  fragment_size = 1088
 }
@@ -3,5 +3,5 @@
 charon {
  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown

-  fragment_size = 1024
+  fragment_size = 1088
 }
@@ -13,12 +13,12 @@ conn net-net
 	left=PH_IP_MOON
 	leftsubnet=10.1.0.0/16
 	[email protected]
-	leftsigkey=moonPub.der
+	leftsigkey=moonPub.pem
 	leftauth=pubkey
 	leftfirewall=yes
 	right=PH_IP_SUN
 	rightsubnet=10.2.0.0/16
 	[email protected]
-	rightsigkey=sunPub.der
+	rightsigkey=sunPub.pem
 	rightauth=pubkey
 	auto=add
@@ -1,3 +0,0 @@
-# /etc/ipsec.secrets - strongSwan IPsec secrets file
-
-: RSA moonKey.der
@@ -13,10 +13,10 @@ conn net-net
 	left=PH_IP_SUN
 	leftsubnet=10.2.0.0/16
 	[email protected]
-	leftsigkey=sunPub.der
+	leftsigkey=sunPub.pem
 	leftfirewall=yes
 	right=PH_IP_MOON
 	rightsubnet=10.1.0.0/16
 	[email protected]
-	rightsigkey=moonPub.der
+	rightsigkey=moonPub.pem
 	auto=add
@@ -1,3 +0,0 @@
-# /etc/ipsec.secrets - strongSwan IPsec secrets file
-
-: RSA sunKey.der
@@ -1,6 +1,6 @@
 #!/bin/bash

-cd /etc/openssl
+cd /etc/ca

 echo "Content-type: application/ocsp-response"
 echo ""
@@ -31,11 +31,11 @@ conn %default
 conn alice
 	leftsubnet=PH_IP_ALICE/32
 	right=%any
-	rightca="C=CH, O=Linux strongSwan, OU=Research, CN=Research CA"
+	rightca="C=CH, O=strongSwan Project, OU=Research, CN=Research CA"
 	auto=add
-	
+
 conn venus
 	leftsubnet=PH_IP_VENUS/32
 	right=%any
-	rightca="C=CH, O=Linux strongSwan, OU=Sales, CN=Sales CA"
+	rightca="C=CH, O=strongSwan Project, OU=Sales, CN=Sales CA"
 	auto=add
@@ -4,5 +4,7 @@ dave::ipsec start
 moon::expect-connection alice
 carol::expect-connection alice
 carol::ipsec up alice
+carol::ipsec up venus
 dave::expect-connection venus
 dave::ipsec up venus
+dave::ipsec up alice
@@ -1,6 +1,6 @@
 #!/bin/bash

-cd /etc/openssl
+cd /etc/ca

 echo "Content-type: application/ocsp-response"
 echo ""
@@ -15,7 +15,7 @@ conn %default
 	rekeymargin=3m
 	keyingtries=1
 	left=PH_IP_CAROL
-	leftcert=carolRevokedCert.pem
+	leftcert=carolCert.pem
 	[email protected]

 conn home
@@ -1,3 +1,3 @@
 # /etc/ipsec.secrets - strongSwan IPsec secrets file

-: RSA carolRevokedKey.pem
+: RSA carolKey.pem
@@ -1,4 +1,2 @@
 moon::ipsec stop
 carol::ipsec stop
-carol::rm /etc/ipsec.d/private/*
-carol::rm /etc/ipsec.d/certs/*
@@ -15,7 +15,7 @@ conn %default
 	rekeymargin=3m
 	keyingtries=1
 	left=PH_IP_CAROL
-	leftcert=carolCert-ocsp.pem
+	leftcert=carolCert.pem
 	[email protected]

 conn home
@@ -1,3 +1,3 @@
 # /etc/ipsec.secrets - strongSwan IPsec secrets file

-: RSA carolKey-ocsp.pem
+: RSA carolKey.pem
@@ -1,4 +1,2 @@
 moon::ipsec stop
 carol::ipsec stop
-carol::rm /etc/ipsec.d/certs/*
-carol::rm /etc/ipsec.d/private/*
@@ -10,14 +10,14 @@ conn %default
 	keyingtries=1
 	keyexchange=ikev2
 	left=PH_IP_CAROL
-	leftcert=carolCert-ifuri.pem
+	leftcert=carolCert.pem
 	right=PH_IP_MOON
 	[email protected]

 conn alice
 	rightsubnet=PH_IP_ALICE/32
 	auto=add
-	
+
 conn venus
 	rightsubnet=PH_IP_VENUS/32
 	auto=add
@@ -2,7 +2,7 @@

 config setup
 	strictcrlpolicy=ifuri
-	
+
 conn %default
 	ikelifetime=60m
 	keylife=20m
@@ -10,14 +10,14 @@ conn %default
 	keyingtries=1
 	keyexchange=ikev2
 	left=PH_IP_DAVE
-	leftcert=daveCert-ifuri.pem
+	leftcert=daveCert.pem
 	right=PH_IP_MOON
 	[email protected]

 conn alice
 	rightsubnet=PH_IP_ALICE/32
 	auto=add
-	
+
 conn venus
 	rightsubnet=PH_IP_VENUS/32
 	auto=add
@@ -16,11 +16,11 @@ conn %default
 conn alice
 	leftsubnet=PH_IP_ALICE/32
 	right=%any
-	rightca="C=CH, O=Linux strongSwan, OU=Research, CN=Research CA"
+	rightca="C=CH, O=strongSwan Project, OU=Research, CN=Research CA"
 	auto=add
-	
+
 conn venus
 	leftsubnet=PH_IP_VENUS/32
 	right=%any
-	rightca="C=CH, O=Linux strongSwan, OU=Sales, CN=Sales CA"
+	rightca="C=CH, O=strongSwan Project, OU=Sales, CN=Sales CA"
 	auto=add
@@ -8,7 +8,7 @@ ca strongswan-ca
        ocspuri1=http://bob.strongswan.org:8800
 	ocspuri2=http://ocsp.strongswan.org:8880
 	auto=add
-			
+
 conn %default
 	keyexchange=ikev2
 	ikelifetime=60m
@@ -16,7 +16,7 @@ conn %default
 	rekeymargin=3m
 	keyingtries=1
 	left=PH_IP_CAROL
-	leftcert=carolCert-ocsp.pem
+	leftcert=carolCert.pem
 	[email protected]

 conn home
@@ -1,3 +1,3 @@
 # /etc/ipsec.secrets - strongSwan IPsec secrets file

-: RSA carolKey-ocsp.pem
+: RSA carolKey.pem
--- a/Show More
+++ b/Show More