testing: Script building fresh certificates

testing/hosts/winnetou/etc/apache2/sites-enabled/001-ocsp_vhost.conf

@@ -6,11 +6,11 @@ AddHandler cgi-script .cgi
 
 <VirtualHost *:8880>
     ServerAdmin  [email protected]
-    DocumentRoot /etc/openssl/ocsp
+    DocumentRoot /etc/ca/ocsp
     ServerName   ocsp.strongswan.org
     ServerAlias	 192.168.0.150
     DirectoryIndex ocsp.cgi
-    <Directory "/etc/openssl/ocsp">
+    <Directory "/etc/ca/ocsp">
         Options  +ExecCGI
         Require all granted
    </Directory>
@@ -22,11 +22,11 @@ Listen 8881
 
 <VirtualHost *:8881>
     ServerAdmin  [email protected]
-    DocumentRoot /etc/openssl/research/ocsp
+    DocumentRoot /etc/ca/research/ocsp
     ServerName   ocsp.research.strongswan.org
     ServerAlias	 ocsp.strongswan.org 192.168.0.150
     DirectoryIndex ocsp.cgi
-    <Directory "/etc/openssl/research/ocsp">
+    <Directory "/etc/ca/research/ocsp">
         Options +ExecCGI
         Require all granted
    </Directory>
@@ -38,11 +38,11 @@ Listen 8882
 
 <VirtualHost *:8882>
     ServerAdmin  [email protected]
-    DocumentRoot /etc/openssl/sales/ocsp
+    DocumentRoot /etc/ca/sales/ocsp
     ServerName   ocsp.sales.strongswan.org
     ServerAlias	 ocsp.strongswan.org 192.168.0.150
     DirectoryIndex ocsp.cgi
-    <Directory "/etc/openssl/sales/ocsp">
+    <Directory "/etc/ca/sales/ocsp">
         Options +ExecCGI
         Require all granted
    </Directory>

testing/hosts/winnetou/etc/ca/generate-crl

@@ -0,0 +1,133 @@
+#!/bin/bash
+
+export LEAK_DETECTIVE_DISABLE=1
+
+ROOT="/var/www"
+
+##
+# strongSwan Root CA
+cd /etc/ca
+
+# copy strongsSwan CA certificate
+cp strongswanCert.pem ${ROOT}
+cp strongswanCert.der ${ROOT}
+
+# generate CRL for strongSwan Root CA
+pki --signcrl --cakey strongswanKey.pem --cacert strongswanCert.pem \
+    --lastcrl strongswan.crl > ${ROOT}/strongswan.crl
+
+# revoke moon's current certificate
+pki --signcrl --cakey strongswanKey.pem --cacert strongswanCert.pem \
+    --reason key-compromise --serial 03 \
+    --lastcrl ${ROOT}/strongswan.crl > ${ROOT}/strongswan_moon_revoked.crl
+
+# generate a base CRL
+pki --signcrl --cakey strongswanKey.pem --cacert strongswanCert.pem \
+    --crluri http://crl.strongswan.org/strongswan_delta.crl \
+    --lastcrl strongswan.crl --lifetime 30 > ${ROOT}/strongswan_base.crl
+
+# generate a delta CRL revoking moon's current cert
+pki --signcrl --cakey strongswanKey.pem --cacert strongswanCert.pem \
+    --basecrl ${ROOT}/strongswan_base.crl --reason key-compromise \
+    --serial 03 --lifetime 15 > ${ROOT}/strongswan_delta.crl
+
+# generate Hash-and-URL certificates
+CERTS_DIR="${ROOT}/certs"
+for cert in `ls certs`
+do
+  openssl x509 -in certs/${cert} -outform der -out ${CERTS_DIR}/cert.der
+  mv ${CERTS_DIR}/cert.der ${CERTS_DIR}/`sha1sum ${CERTS_DIR}/cert.der | head -c 40`
+done
+
+##
+# Research CA
+cd /etc/ca/research
+
+# copy Research CA certificate
+cp researchCert.pem ${ROOT}
+cp researchCert.der ${ROOT}
+
+# generate CRL for Research CA
+pki --signcrl --cakey researchKey.pem --cacert researchCert.pem \
+    > ${ROOT}/research.crl
+
+# generate Hash-and-URL certificates
+CERTS_DIR="${ROOT}/certs/research"
+for cert in `ls certs`
+do
+  openssl x509 -in certs/${cert} -outform der -out ${CERTS_DIR}/cert.der
+  mv ${CERTS_DIR}/cert.der ${CERTS_DIR}/`sha1sum ${CERTS_DIR}/cert.der | head -c 40`
+done
+
+##
+# Sales CA
+cd /etc/ca/sales
+
+# copy Sales CA certificate
+cp salesCert.pem ${ROOT}
+cp salesCert.der ${ROOT}
+
+# generate CRL for Sales CA
+pki --signcrl --cakey salesKey.pem --cacert salesCert.pem \
+    > ${ROOT}/sales.crl
+
+# generate Hash-and-URL certificates
+CERTS_DIR="${ROOT}/certs/sales"
+for cert in `ls certs`
+do
+  openssl x509 -in certs/${cert} -outform der -out ${CERTS_DIR}/cert.der
+  mv ${CERTS_DIR}/cert.der ${CERTS_DIR}/`sha1sum ${CERTS_DIR}/cert.der | head -c 40`
+done
+
+##
+# strongSwan EC Root CA
+cd /etc/ca/ecdsa
+
+# copy ECDSA CA certificate
+cp strongswanCert.pem ${ROOT}/strongswan_ecdsaCert.pem
+openssl ec -in strongswanKey.pem -outform der -out ${ROOT}/strongswan_ecdsaCert.der
+chmod a+r ${ROOT}/strongswan_ecdsaCert.der
+
+# generate CRL for strongSwan EC Root CA
+pki --signcrl --cakey strongswanKey.pem --cacert strongswanCert.pem \
+    > ${ROOT}/strongswan_ecdsa.crl
+
+##
+# strongSwan RFC3779 Root CA
+cd /etc/ca/rfc3779
+
+# generate CRL for strongSwan RFC3779 Root CA
+pki --signcrl --cakey strongswanKey.pem --cacert strongswanCert.pem \
+    > ${ROOT}/strongswan_rfc3779.crl
+
+##
+# strongSwan SHA3-RSA Root CA
+cd /etc/ca/sha3-rsa
+
+# generate CRL for strongSwan SHA3-RSA Root CA
+pki --signcrl --cakey strongswanKey.pem --cacert strongswanCert.pem \
+    --digest sha3_256 > ${ROOT}/strongswan_sha3_rsa.crl
+
+##
+# strongSwan Ed25519 Root CA
+cd /etc/ca/ed25519
+
+# generate CRL for strongSwan Ed25519 Root CA
+pki --signcrl --cakey strongswanKey.pem --cacert strongswanCert.pem \
+    > ${ROOT}/strongswan_ed25519.crl
+
+##
+# strongSwan Monster Root CA
+cd /etc/ca/monster
+
+# generate CRL for strongSwan Monster Root CA
+pki --signcrl --cakey strongswanKey.pem --cacert strongswanCert.pem \
+    > ${ROOT}/strongswan_monster.crl
+
+##
+# strongSwan BlISS Root CA
+cd /etc/ca/bliss
+
+# generate CRL for strongSwan BLISS Root CA
+pki --signcrl --cakey strongswan_blissKey.der --cacert strongswan_blissCert.der \
+    --lifetime 30 --digest sha3_512 > ${ROOT}/strongswan_bliss.crl

testing/hosts/winnetou/etc/ca/index.html

@@ -0,0 +1,58 @@
+<html>
+<head>
+  <title>strongSwan Web Services</title>
+  <base target="_self">
+</head>
+
+<body bgcolor="#FFFFFF">
+<table border=0 cellpadding=0 cellspacing=0 width=600>
+
+<tr><td>
+  <h2>strongSwan Testing Environment</h2>
+  <ul>
+    <li>
+      <a href="testresults/">Test Results</a>
+    </li>
+  </ul>
+  <a href="images/umlArchitecture_large.png" target="_blank">
+    <img src="images/umlArchitecture_small.png" border="0">
+  </a>
+
+    <h2>strongSwan Certification Authorities</h2>
+  <ul>
+    <li>
+      <bold>Root CA: </bold>
+      <a href="strongswanCert.pem">PEM</a> ,
+      <a href="strongswanCert.der">DER</a> ,
+      <a href="strongswan.crl">CRL</a>
+    </li>
+  </ul>
+  <ul>
+    <li>
+      <bold>Research CA: </bold>
+      <a href="researchCert.pem">PEM</a> ,
+      <a href="researchCert.der">DER</a> ,
+      <a href="research.crl">CRL</a>
+    </li>
+  </ul>
+  <ul>
+    <li>
+      <bold>Sales CA: </bold>
+       <a href="salesCert.pem">PEM</a> ,
+      <a href="salesCert.der">DER</a> ,
+      <a href="sales.crl">CRL</a>
+    </li>
+  </ul>
+  <ul>
+    <li>
+      <bold>ECDSA CA: </bold>
+      <a href="strongswan_ecdsaCert.pem">PEM</a> ,
+      <a href="strongswan_ecdsaCert.der">DER</a> ,
+     <a href="strongswan_ecdsa.crl">CRL</a>
+    </li>
+  </ul>
+  <hr>
+  <address>The strongSwan Project (<a href="https://www.strongswan.org">www.strongswan.org</a>)</address>
+</td></tr>
+</table>
+</body>

testing/hosts/winnetou/etc/ca/index.txt.template

@@ -0,0 +1,22 @@
+V	EE_EXPIRATION		01	unknown	/C=CH/O=strongSwan Project/OU=Research/[email protected]
+V	EE_EXPIRATION		02	unknown	/C=CH/O=strongSwan Project/OU=Accounting/[email protected]
+V	EE_EXPIRATION		03	unknown	/C=CH/O=strongSwan Project/CN=moon.strongswan.org
+V	EE_EXPIRATION		04	unknown	/C=CH/O=strongSwan Project/CN=sun.strongswan.org
+V	EE_EXPIRATION		05	unknown	/C=CH/O=strongSwan Project/OU=Sales/[email protected]
+V	EE_EXPIRATION		06	unknown	/C=CH/O=strongSwan Project/CN=venus.strongswan.org
+V	EE_EXPIRATION		07	unknown	/C=CH/O=strongSwan Project/OU=Research/[email protected]
+R	EE_EXPIRATION	REVOCATION,keyCompromise	08	unknown	/C=CH/O=strongSwan Project/OU=Research/[email protected]
+V	EE_EXPIRATION		09	unknown	/C=CH/O=strongSwan Project/OU=Research/serialNumber=002/[email protected]
+R	IM_EXPIRATION	REVOCATION,CACompromise	0A	unknown	/C=CH/O=strongSwan Project/OU=Research/CN=Research CA
+V	IM_EXPIRATION		0B	unknown	/C=CH/O=strongSwan Project/OU=Research/CN=Research CA
+V	IM_EXPIRATION		0C	unknown	/C=CH/O=strongSwan Project/OU=Sales/CN=Sales CA
+V	EE_EXPIRATION		0D	unknown	/C=CH/O=strongSwan Project/OU=SHA-224/CN=moon.strongswan.org
+V	EE_EXPIRATION		0E	unknown	/C=CH/O=strongSwan Project/OU=SHA-384/[email protected]
+V	EE_EXPIRATION		0F	unknown	/C=CH/O=strongSwan Project/OU=SHA-512/[email protected]
+V	EE_EXPIRATION		10	unknown	/C=CH/O=strongSwan Project/OU=OCSP/[email protected]
+V	EE_EXPIRATION		11	unknown	/C=CH/O=strongSwan Project/OU=OCSP Signing Authority/CN=ocsp.strongswan.org
+V	EE_EXPIRATION		12	unknown	/C=CH/O=strongSwan Project/OU=Virtual VPN Gateway/CN=mars.strongswan.org
+V	EE_EXPIRATION		13	unknown	/C=CH/O=strongSwan Project/CN=winnetou.strongswan.org
+V	EE_EXPIRATION		14	unknown	/C=CH/O=strongSwan Project/CN=aaa.strongswan.org
+V	IM_EXPIRATION		15	unknown	/C=CH/O=strongSwan Project/CN=strongSwan Attribute Authority
+V	SH_EXPIRATION		16	unknown	/C=CH/O=strongSwan Project/CN=strongSwan Legacy AA

testing/hosts/winnetou/etc/ca/ocsp/ocsp.cgi

@@ -0,0 +1,11 @@
+#!/bin/bash
+
+cd /etc/ca
+
+echo "Content-type: application/ocsp-response"
+echo ""
+
+cat | /usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \
+	-rkey ocspKey.pem -rsigner ocspCert.pem \
+	-nmin 5 \
+	-reqin /dev/stdin -respout /dev/stdout | cat

testing/hosts/winnetou/etc/ca/research/index.txt.template

@@ -0,0 +1,4 @@
+V	EE_EXPIRATION		01	unknown	/C=CH/O=strongSwan Project/OU=Research/[email protected]
+V	EE_EXPIRATION		02	unknown	/C=CH/O=strongSwan Project/OU=Research OCSP Signing Authority/CN=ocsp.research.strongswan.org
+V	EE_EXPIRATION		03	unknown	/C=CH/O=strongSwan Project/OU=Sales/CN=Sales CA
+V	EE_EXPIRATION		04	unknown	/C=CH/O=strongSwan Project/OU=Research/CN=Duck Research CA

testing/hosts/winnetou/etc/ca/research/ocsp/ocsp.cgi

@@ -0,0 +1,11 @@
+#!/bin/bash
+
+cd /etc/ca/research
+
+echo "Content-type: application/ocsp-response"
+echo ""
+
+cat | /usr/bin/openssl ocsp -index index.txt -CA researchCert.pem \
+	-rkey ocspKey.pem -rsigner ocspCert.pem \
+	-nmin 5 \
+	-reqin /dev/stdin -respout /dev/stdout | cat

testing/hosts/winnetou/etc/ca/sales/index.txt.template

@@ -0,0 +1,3 @@
+V	EE_EXPIRATION		01	unknown	/C=CH/O=strongSwan Project/OU=Sales/[email protected]
+V	EE_EXPIRATION		02	unknown	/C=CH/O=strongSwan Project/OU=Sales OCSP Signing Authority/CN=ocsp.sales.strongswan.org
+V	EE_EXPIRATION		03	unknown	/C=CH/O=strongSwan Project/OU=Research/CN=Research CA

testing/hosts/winnetou/etc/ca/sales/ocsp/ocsp.cgi

@@ -0,0 +1,11 @@
+#!/bin/bash
+
+cd /etc/ca/sales
+
+echo "Content-type: application/ocsp-response"
+echo ""
+
+cat | /usr/bin/openssl ocsp -index index.txt -CA salesCert.pem \
+	-rkey ocspKey.pem -rsigner ocspCert.pem \
+	-nmin 5 \
+	-reqin /dev/stdin -respout /dev/stdout | cat

testing/hosts/winnetou/etc/ldap/ldif.txt

@@ -1,39 +1,39 @@
-dn: o=Linux strongSwan, c=CH
+dn: o=strongSwan Project, c=CH
 objectclass: organization
-o: Linux strongSwan
+o: strongSwan Project
 
-dn: cn=Manager,o=Linux strongSwan, c=CH
+dn: cn=Manager,o=strongSwan Project, c=CH
 objectclass: organizationalRole
 cn: Manager
 
-dn: cn=strongSwan Root CA, o=Linux strongSwan, c=CH
+dn: cn=strongSwan Root CA, o=strongSwan Project, c=CH
 objectClass: organizationalRole
 cn: strongSwan Root CA
 objectClass: certificationAuthority
-authorityRevocationList;binary:< file:///etc/openssl/strongswan.crl
+authorityRevocationList;binary:< file:///var/www/strongswan.crl
-certificateRevocationList;binary:< file:///etc/openssl/strongswan.crl
+certificateRevocationList;binary:< file:///var/www/strongswan.crl
-cACertificate;binary:< file:///etc/openssl/strongswanCert.der
+cACertificate;binary:< file:///var/www/strongswanCert.der
 
-dn: ou=Research, o=Linux strongSwan, c=CH
+dn: ou=Research, o=strongSwan Project, c=CH
 objectclass: organizationalUnit
 ou: Research
 
-dn: cn=Research CA, ou=Research, o=Linux strongSwan, c=CH
+dn: cn=Research CA, ou=Research, o=strongSwan Project, c=CH
 objectClass: organizationalRole
 cn: Research CA
 objectClass: certificationAuthority
-authorityRevocationList;binary:< file:///etc/openssl/research/research.crl
+authorityRevocationList;binary:< file:///var/www/research.crl
-certificateRevocationList;binary:< file:///etc/openssl/research/research.crl
+certificateRevocationList;binary:< file:///var/www/research.crl
-cACertificate;binary:< file:///etc/openssl/research/researchCert.der
+cACertificate;binary:< file:///var/www/researchCert.der
 
-dn: ou=Sales, o=Linux strongSwan, c=CH
+dn: ou=Sales, o=strongSwan Project, c=CH
 objectclass: organizationalUnit
 ou: Sales
 
-dn: cn=Sales CA, ou=Sales, o=Linux strongSwan, c=CH
+dn: cn=Sales CA, ou=Sales, o=strongSwan Project, c=CH
 objectClass: organizationalRole
 cn: Sales CA
 objectClass: certificationAuthority
-authorityRevocationList;binary:< file:///etc/openssl/sales/sales.crl
+authorityRevocationList;binary:< file:///var/www/sales.crl
-certificateRevocationList;binary:< file:///etc/openssl/sales/sales.crl
+certificateRevocationList;binary:< file:///var/www/sales.crl
-cACertificate;binary:< file:///etc/openssl/sales/salesCert.der
+cACertificate;binary:< file:///var/www/salesCert.der

testing/hosts/winnetou/etc/ldap/slapd.conf

@@ -15,8 +15,8 @@ argsfile	/var/run/openldap/slapd.args
 #######################################################################
 
 database	bdb
-suffix		"o=Linux strongSwan,c=CH"
+suffix		"o=strongSwan Project,c=CH"
-rootdn		"cn=Manager,o=Linux strongSwan,c=CH"
+rootdn		"cn=Manager,o=strongSwan Project,c=CH"
 checkpoint	32	30
 rootpw		tuxmux
 directory	/var/lib/ldap

testing/hosts/winnetou/etc/openssl/index.html

@@ -1,36 +0,0 @@
-<html>
-<head>
-  <title>strongSwan Web Services</title>
-  <base target="_self">
-</head>
-
-<body bgcolor="#FFFFFF">
-<table border=0 cellpadding=0 cellspacing=0 width=600>
-
-<tr><td>
-  <h2>strongSwan Certification Authority</h2>
-  <ul>
-    <li>
-      <a href="strongswanCert.pem">Root CA Certificate</a>
-    </li>
-  </ul>
-  <ul>
-    <li>
-      <a href="strongswan.crl">Certificate Revocation List (CRL)</a>
-    </li>
-  </ul>
-
-  <h2>strongSwan Testing Environment</h2>
-  <ul>
-    <li>
-      <a href="testresults/">Test Results</a>
-    </li>
-  </ul>
-  <a href="images/umlArchitecture_large.png" target="_blank">
-    <img src="images/umlArchitecture_small.png" border="0">
-  </a>
-  <hr>
-  <address>Linux strongSwan (<a href="http://www.strongswan.org">www.strongswan.org</a>)</address>
-</td></tr>
-</table>
-</body>

testing/hosts/winnetou/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # strongswan.conf - strongSwan configuration file
 
 pki {
-  load = random pem sha1 sha2 sha3 pkcs1 pkcs8 pem gmp mgf1 bliss curve25519 x509
+  load = random pem sha1 sha2 sha3 pkcs1 pkcs8 pem gmp mgf1 bliss curve25519 x509 openssl
 }

testing/scripts/build-guestimages

@@ -65,8 +65,9 @@ do
 		echo "/testresults /var/www/testresults 9p trans=virtio,version=9p2000.L 0 0" >> $LOOPDIR/etc/fstab
 		execute_chroot "a2enmod -q cgid" 0
 		execute_chroot "a2enmod -q rewrite" 0
-		execute_chroot "ln -s /etc/openssl/certs /var/www/certs" 0
+		execute_chroot "mkdir /var/www/certs" 0
-		execute_chroot "/etc/openssl/generate-crl" 0
+		execute_chroot "mkdir /var/www/certs/research /var/www/certs/sales" 0
+		execute_chroot "/etc/ca/generate-crl" 0
 		execute_chroot "rm -rf /var/lib/ldap/*" 0
 		execute_chroot "slapadd -l /etc/ldap/ldif.txt -f /etc/ldap/slapd.conf" 0
 		execute_chroot "chown -R openldap:openldap /var/lib/ldap" 0

testing/tests/botan/rw-cert/hosts/carol/etc/swanctl/rsa/carolKey.pem

@@ -1,30 +0,0 @@
------BEGIN RSA PRIVATE KEY-----
-Proc-Type: 4,ENCRYPTED
-DEK-Info: AES-128-CBC,7E1D40A7901772BA4D22AF58AA2DC76F
-
-1jt4EsxtHvgpSLN8PA/kSVKgoAsBEBQb8RK6VGnZywMCnpJdLKdPisGGYKNPg53b
-/0AFBmQVE60M8icbSAIUrAtyKxaBkoc9A7ibNCjobi0UzXTm3GcZZ1EC4/lE9PQZ
-/2FbcPgQWN3kZraZDkeP9XBXl6PorES8xvQUxJ9pd4hL7/c28fIApGhEimkIZO8o
-Qb7bR2cNCLYQAR6PeDoqhV39gvWoh77wp1WB3tQVbkS6MI/xl3wY2QVdq3Sbszh+
-f6lDU/SZS8BU0f44FRoInPp0GasgJ7MCiuEIshjuNPa50QkMcnNJsSgVEuw2hjN6
-LvAXx7vPt9pKpQfnu7YSJUsXDYN6PyXt7sZ8hDqraYIcI6eMpEBaTpItPSV2eckv
-06KC24Oa66E1yufNFAY49S2OY+pJA0W5zmcCqCjdrfJ+wNQYKZpbrfGz4VRzlFJC
-e3VkmAFwA5rcZdlp/mU2XREy+TaWsHMnpL0NcMHGmsfkTgaJIkRWalrdxlNTeitr
-3boNHWk0ESyMcBYRpM3eNXsGpiYy93u0bhrPbnqJsV6miKqpbs1aBNjlJ9s1Y2fC
-sko5/v7uMjb5tLF3lWQZfTu+bYtpGxFrqHJjhd8yd4gL1cFi30JcjczhwRY3Dily
-c0BFekMGmPc1djn6tfIFu13X9xTxyidCpVaT9UGnOaQs9OF1u8XAnZDaQgPwjLiy
-UlOE8xQ60LrhWLD582FsFnZz56bZ+QOQRWDMsB8nJeqnFXKfcRlnr0qlG6lTfA8h
-XkK/qGpdVvivS+CpbhVP6ixdEfa91Rx4NjLj53LGqOYwFEkM/OAIuMJetBfx3v9T
-iQfv594KE32nv9besnKlmJr2cGQWBYg1pUOtFj/aZ00yuXacv8qwzbrt4xGGDYGO
-Aj5Yf93UEcVkTySO1xJ1yiC6GJv1lLm0i5StwykHypxFijKe/zOpgtHVa5v5igjO
-v6cfhfJGGgIPTYrtt+EDKXcayvy2e2U/3HYVCHYiiMPX8AvP/R6m7MGrzYxm/WyO
-t68EWXSDLfuR3qcIlpP4aSBxuSpKhY/dIkS/beKZ7Njx1s4jSuYDMbKuuCRFSU2H
-8ISHS0kh3FetiS8IyIYzxab+KQZwnVtiGj4oaAhgFTIIoH26Fv5+xka74JdzOSUA
-jR9puKuxaegVWQVBx4cCyg6hAdewRm64PAcbApZWrPvMPBfTZFnXeifmaurcdK8p
-p/1eLrrPnNM6+Fh6lcKdX74yHPz3eWP3K1njZegzWnChhEWElPhJr6qYNQjd+lAS
-7650RJ3CJLUxBffnRR9nTArxFNI5jGWg/plLJTaRT5x5qg1dGNMqntpoeiY++Ttk
-GFDGVIOICBze6SOvzkZBbuXLJSWmWj5g9J2cYsLoOvlwsDT7FzKl8p6VY4V+SQb+
-4PN8qZWmOeczaLEhZ1QLmTKFpz9+wUZsXeBd1s78bWJR0zhraMPa0UJ9GBGq6uQ0
-yZ4Xm5KHKcgoewCUQMekU9ECsmR5NuC7VFDaa1OdPEVnEYR1xtaWUY0lYKOiixnd
-+85fSq/yAXI/r0O4ISA55o9y1kDqVibTwJacb6xXGg8dHSH+TtigwD8fK9mekkDC
------END RSA PRIVATE KEY-----

testing/tests/botan/rw-ecp256/hosts/carol/etc/swanctl/rsa/carolKey.pem

@@ -1,30 +0,0 @@
------BEGIN RSA PRIVATE KEY-----
-Proc-Type: 4,ENCRYPTED
-DEK-Info: AES-128-CBC,7E1D40A7901772BA4D22AF58AA2DC76F
-
-1jt4EsxtHvgpSLN8PA/kSVKgoAsBEBQb8RK6VGnZywMCnpJdLKdPisGGYKNPg53b
-/0AFBmQVE60M8icbSAIUrAtyKxaBkoc9A7ibNCjobi0UzXTm3GcZZ1EC4/lE9PQZ
-/2FbcPgQWN3kZraZDkeP9XBXl6PorES8xvQUxJ9pd4hL7/c28fIApGhEimkIZO8o
-Qb7bR2cNCLYQAR6PeDoqhV39gvWoh77wp1WB3tQVbkS6MI/xl3wY2QVdq3Sbszh+
-f6lDU/SZS8BU0f44FRoInPp0GasgJ7MCiuEIshjuNPa50QkMcnNJsSgVEuw2hjN6
-LvAXx7vPt9pKpQfnu7YSJUsXDYN6PyXt7sZ8hDqraYIcI6eMpEBaTpItPSV2eckv
-06KC24Oa66E1yufNFAY49S2OY+pJA0W5zmcCqCjdrfJ+wNQYKZpbrfGz4VRzlFJC
-e3VkmAFwA5rcZdlp/mU2XREy+TaWsHMnpL0NcMHGmsfkTgaJIkRWalrdxlNTeitr
-3boNHWk0ESyMcBYRpM3eNXsGpiYy93u0bhrPbnqJsV6miKqpbs1aBNjlJ9s1Y2fC
-sko5/v7uMjb5tLF3lWQZfTu+bYtpGxFrqHJjhd8yd4gL1cFi30JcjczhwRY3Dily
-c0BFekMGmPc1djn6tfIFu13X9xTxyidCpVaT9UGnOaQs9OF1u8XAnZDaQgPwjLiy
-UlOE8xQ60LrhWLD582FsFnZz56bZ+QOQRWDMsB8nJeqnFXKfcRlnr0qlG6lTfA8h
-XkK/qGpdVvivS+CpbhVP6ixdEfa91Rx4NjLj53LGqOYwFEkM/OAIuMJetBfx3v9T
-iQfv594KE32nv9besnKlmJr2cGQWBYg1pUOtFj/aZ00yuXacv8qwzbrt4xGGDYGO
-Aj5Yf93UEcVkTySO1xJ1yiC6GJv1lLm0i5StwykHypxFijKe/zOpgtHVa5v5igjO
-v6cfhfJGGgIPTYrtt+EDKXcayvy2e2U/3HYVCHYiiMPX8AvP/R6m7MGrzYxm/WyO
-t68EWXSDLfuR3qcIlpP4aSBxuSpKhY/dIkS/beKZ7Njx1s4jSuYDMbKuuCRFSU2H
-8ISHS0kh3FetiS8IyIYzxab+KQZwnVtiGj4oaAhgFTIIoH26Fv5+xka74JdzOSUA
-jR9puKuxaegVWQVBx4cCyg6hAdewRm64PAcbApZWrPvMPBfTZFnXeifmaurcdK8p
-p/1eLrrPnNM6+Fh6lcKdX74yHPz3eWP3K1njZegzWnChhEWElPhJr6qYNQjd+lAS
-7650RJ3CJLUxBffnRR9nTArxFNI5jGWg/plLJTaRT5x5qg1dGNMqntpoeiY++Ttk
-GFDGVIOICBze6SOvzkZBbuXLJSWmWj5g9J2cYsLoOvlwsDT7FzKl8p6VY4V+SQb+
-4PN8qZWmOeczaLEhZ1QLmTKFpz9+wUZsXeBd1s78bWJR0zhraMPa0UJ9GBGq6uQ0
-yZ4Xm5KHKcgoewCUQMekU9ECsmR5NuC7VFDaa1OdPEVnEYR1xtaWUY0lYKOiixnd
-+85fSq/yAXI/r0O4ISA55o9y1kDqVibTwJacb6xXGg8dHSH+TtigwD8fK9mekkDC
------END RSA PRIVATE KEY-----

testing/tests/botan/rw-modp3072/hosts/carol/etc/swanctl/rsa/carolKey.pem

@@ -1,30 +0,0 @@
------BEGIN RSA PRIVATE KEY-----
-Proc-Type: 4,ENCRYPTED
-DEK-Info: AES-128-CBC,7E1D40A7901772BA4D22AF58AA2DC76F
-
-1jt4EsxtHvgpSLN8PA/kSVKgoAsBEBQb8RK6VGnZywMCnpJdLKdPisGGYKNPg53b
-/0AFBmQVE60M8icbSAIUrAtyKxaBkoc9A7ibNCjobi0UzXTm3GcZZ1EC4/lE9PQZ
-/2FbcPgQWN3kZraZDkeP9XBXl6PorES8xvQUxJ9pd4hL7/c28fIApGhEimkIZO8o
-Qb7bR2cNCLYQAR6PeDoqhV39gvWoh77wp1WB3tQVbkS6MI/xl3wY2QVdq3Sbszh+
-f6lDU/SZS8BU0f44FRoInPp0GasgJ7MCiuEIshjuNPa50QkMcnNJsSgVEuw2hjN6
-LvAXx7vPt9pKpQfnu7YSJUsXDYN6PyXt7sZ8hDqraYIcI6eMpEBaTpItPSV2eckv
-06KC24Oa66E1yufNFAY49S2OY+pJA0W5zmcCqCjdrfJ+wNQYKZpbrfGz4VRzlFJC
-e3VkmAFwA5rcZdlp/mU2XREy+TaWsHMnpL0NcMHGmsfkTgaJIkRWalrdxlNTeitr
-3boNHWk0ESyMcBYRpM3eNXsGpiYy93u0bhrPbnqJsV6miKqpbs1aBNjlJ9s1Y2fC
-sko5/v7uMjb5tLF3lWQZfTu+bYtpGxFrqHJjhd8yd4gL1cFi30JcjczhwRY3Dily
-c0BFekMGmPc1djn6tfIFu13X9xTxyidCpVaT9UGnOaQs9OF1u8XAnZDaQgPwjLiy
-UlOE8xQ60LrhWLD582FsFnZz56bZ+QOQRWDMsB8nJeqnFXKfcRlnr0qlG6lTfA8h
-XkK/qGpdVvivS+CpbhVP6ixdEfa91Rx4NjLj53LGqOYwFEkM/OAIuMJetBfx3v9T
-iQfv594KE32nv9besnKlmJr2cGQWBYg1pUOtFj/aZ00yuXacv8qwzbrt4xGGDYGO
-Aj5Yf93UEcVkTySO1xJ1yiC6GJv1lLm0i5StwykHypxFijKe/zOpgtHVa5v5igjO
-v6cfhfJGGgIPTYrtt+EDKXcayvy2e2U/3HYVCHYiiMPX8AvP/R6m7MGrzYxm/WyO
-t68EWXSDLfuR3qcIlpP4aSBxuSpKhY/dIkS/beKZ7Njx1s4jSuYDMbKuuCRFSU2H
-8ISHS0kh3FetiS8IyIYzxab+KQZwnVtiGj4oaAhgFTIIoH26Fv5+xka74JdzOSUA
-jR9puKuxaegVWQVBx4cCyg6hAdewRm64PAcbApZWrPvMPBfTZFnXeifmaurcdK8p
-p/1eLrrPnNM6+Fh6lcKdX74yHPz3eWP3K1njZegzWnChhEWElPhJr6qYNQjd+lAS
-7650RJ3CJLUxBffnRR9nTArxFNI5jGWg/plLJTaRT5x5qg1dGNMqntpoeiY++Ttk
-GFDGVIOICBze6SOvzkZBbuXLJSWmWj5g9J2cYsLoOvlwsDT7FzKl8p6VY4V+SQb+
-4PN8qZWmOeczaLEhZ1QLmTKFpz9+wUZsXeBd1s78bWJR0zhraMPa0UJ9GBGq6uQ0
-yZ4Xm5KHKcgoewCUQMekU9ECsmR5NuC7VFDaa1OdPEVnEYR1xtaWUY0lYKOiixnd
-+85fSq/yAXI/r0O4ISA55o9y1kDqVibTwJacb6xXGg8dHSH+TtigwD8fK9mekkDC
------END RSA PRIVATE KEY-----

testing/tests/ikev1/multi-level-ca-cr-init/hosts/carol/etc/ipsec.conf

@@ -16,6 +16,6 @@ conn alice
 	leftsendcert=ifasked
 	right=PH_IP_MOON
 	[email protected]
-	rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
+	rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"
 	rightsubnet=PH_IP_ALICE/32
 	auto=add

testing/tests/ikev1/multi-level-ca-cr-init/hosts/dave/etc/ipsec.conf

@@ -16,6 +16,6 @@ conn venus
 	leftsendcert=ifasked
 	right=PH_IP_MOON
 	[email protected]
-	rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
+	rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"
 	rightsubnet=PH_IP_VENUS/32
 	auto=add

testing/tests/ikev1/multi-level-ca-cr-init/hosts/moon/etc/ipsec.conf

@@ -22,12 +22,12 @@ conn alice
 	leftsubnet=PH_IP_ALICE/32
 	right=PH_IP_CAROL
 	[email protected]
-	rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
+	rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"
 	auto=add
-	
+
 conn venus
 	leftsubnet=PH_IP_VENUS/32
 	right=PH_IP_DAVE
 	[email protected]
-	rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
+	rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"
 	auto=add

testing/tests/ikev1/multi-level-ca-cr-resp/hosts/carol/etc/ipsec.conf

@@ -13,7 +13,7 @@ conn %default
 	leftsendcert=ifasked
 	right=PH_IP_MOON
 	[email protected]
-	rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
+	rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"
 
 conn alice
 	rightsubnet=PH_IP_ALICE/32

testing/tests/ikev1/multi-level-ca-cr-resp/hosts/dave/etc/ipsec.conf

@@ -13,7 +13,7 @@ conn %default
 	leftsendcert=ifasked
 	right=PH_IP_MOON
 	[email protected]
-	rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
+	rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"
 
 conn venus
 	rightsubnet=PH_IP_VENUS/32

testing/tests/ikev1/multi-level-ca-cr-resp/hosts/moon/etc/ipsec.conf

@@ -21,11 +21,11 @@ conn %default
 conn alice
 	leftsubnet=PH_IP_ALICE/32
 	right=%any
-	rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
+	rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"
 	auto=add
-	
+
 conn venus
 	leftsubnet=PH_IP_VENUS/32
 	right=%any
-	rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
+	rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"
 	auto=add

testing/tests/ikev1/multi-level-ca/hosts/carol/etc/ipsec.conf

@@ -13,12 +13,12 @@ conn %default
 	leftsendcert=ifasked
 	right=PH_IP_MOON
 	[email protected]
-	rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
+	rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"
 
 conn alice
 	rightsubnet=PH_IP_ALICE/32
 	auto=add
-	
+
 conn venus
 	rightsubnet=PH_IP_VENUS/32
 	auto=add

testing/tests/ikev1/multi-level-ca/hosts/dave/etc/ipsec.conf

@@ -13,12 +13,12 @@ conn %default
 	leftsendcert=ifasked
 	right=PH_IP_MOON
 	[email protected]
-	rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
+	rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"
 
 conn alice
 	rightsubnet=PH_IP_ALICE/32
 	auto=add
-	
+
 conn venus
 	rightsubnet=PH_IP_VENUS/32
 	auto=add

testing/tests/ikev1/multi-level-ca/hosts/moon/etc/ipsec.conf

@@ -21,11 +21,11 @@ conn %default
 conn alice
 	leftsubnet=PH_IP_ALICE/32
 	right=%any
-	rightca="C=CH, O=Linux strongSwan, OU=Research, CN=Research CA"
+	rightca="C=CH, O=strongSwan Project, OU=Research, CN=Research CA"
 	auto=add
-	
+
 conn venus
 	leftsubnet=PH_IP_VENUS/32
 	right=%any
-	rightca="C=CH, O=Linux strongSwan, OU=Sales, CN=Sales CA"
+	rightca="C=CH, O=strongSwan Project, OU=Sales, CN=Sales CA"
 	auto=add

testing/tests/ikev2/acert-cached/posttest.dat

@@ -7,5 +7,5 @@ dave::iptables-restore < /etc/iptables.flush
 moon::rm /etc/ipsec.d/acerts/carol-sales-finance.pem
 moon::rm /etc/ipsec.d/acerts/dave-sales-expired.pem
 moon::rm /etc/ipsec.d/acerts/dave-marketing.pem
-moon::rm /etc/ipsec.d/private/aa.pem
+moon::rm /etc/ipsec.d/private/aaKey.pem
-moon::rm /etc/ipsec.d/aacerts/aa.pem
+moon::rm /etc/ipsec.d/aacerts/aaCert.pem

testing/tests/ikev2/acert-cached/reissue.txt

@@ -1,23 +0,0 @@
-# Carols acert for sales and finance
-pki --acert \
-	--issuercert hosts/moon/etc/ipsec.d/aacerts/aa.pem \
-	--issuerkey hosts/moon/etc/ipsec.d/private/aa.pem \
-	--in ../../../hosts/carol/etc/ipsec.d/certs/carolCert.pem \
-	--group sales --group finance -l 87600 -f pem \
-	> hosts/moon/etc/ipsec.d/acerts/carol-sales-finance.pem
-
-# Daves acert for marketing
-pki --acert \
-	--issuercert hosts/moon/etc/ipsec.d/aacerts/aa.pem \
-	--issuerkey hosts/moon/etc/ipsec.d/private/aa.pem \
-	--in ../../../hosts/dave/etc/ipsec.d/certs/daveCert.pem \
-	--group marketing -l 87600 -f pem \
-	> hosts/moon/etc/ipsec.d/acerts/dave-marketing.pem
-
-# Daves expired acert for sales
-pki --acert \
-	--issuercert hosts/moon/etc/ipsec.d/aacerts/aa.pem \
-	--issuerkey hosts/moon/etc/ipsec.d/private/aa.pem \
-	--in ../../../hosts/dave/etc/ipsec.d/certs/daveCert.pem \
-	--group sales -F "01.01.13 08:00:00" -l 240 -f pem \
-	> hosts/moon/etc/ipsec.d/acerts/dave-sales-expired.pem

testing/tests/ikev2/acert-fallback/posttest.dat

@@ -4,5 +4,5 @@ moon::iptables-restore < /etc/iptables.flush
 carol::iptables-restore < /etc/iptables.flush
 carol::rm /etc/ipsec.d/acerts/carol-sales.pem
 carol::rm /etc/ipsec.d/acerts/carol-finance-expired.pem
-moon::rm /etc/ipsec.d/private/aa.pem
+moon::rm /etc/ipsec.d/private/aaKey.pem
-moon::rm /etc/ipsec.d/aacerts/aa.pem
+moon::rm /etc/ipsec.d/aacerts/aaCert.pem

testing/tests/ikev2/acert-fallback/reissue.txt

@@ -1,15 +0,0 @@
-# Carols expired acert for finance
-pki --acert \
-	--issuercert hosts/moon/etc/ipsec.d/aacerts/aa.pem \
-	--issuerkey hosts/moon/etc/ipsec.d/private/aa.pem \
-	--in ../../../hosts/carol/etc/ipsec.d/certs/carolCert.pem \
-	--group finance -F "01.01.13 08:00:00" -l 240 -f pem \
-	> ./hosts/carol/etc/ipsec.d/acerts/carol-finance-expired.pem
-
-# Carols valid acert for sales
-pki --acert \
-	--issuercert hosts/moon/etc/ipsec.d/aacerts/aa.pem \
-	--issuerkey hosts/moon/etc/ipsec.d/private/aa.pem \
-	--in ../../../hosts/carol/etc/ipsec.d/certs/carolCert.pem \
-	--group sales -l 87600 -f pem \
-	> hosts/carol/etc/ipsec.d/acerts/carol-sales.pem

testing/tests/ikev2/acert-inline/evaltest.dat

@@ -3,9 +3,9 @@ dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*[email protected].*moon.s
 moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*[email protected]::YES
 moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*[email protected]::NO
 moon::cat /var/log/daemon.log::constraint check failed: group membership to 'sales' required::YES
-carol::cat /var/log/daemon.log::sending attribute certificate issued by \"C=CH, O=Linux strongSwan, CN=strongSwan AA\"::YES
+carol::cat /var/log/daemon.log::sending attribute certificate issued by \"C=CH, O=strongSwan Project, CN=strongSwan Attribute Authority\"::YES
-dave::cat /var/log/daemon.log::sending attribute certificate issued by \"C=CH, O=Linux strongSwan, CN=strongSwan AA\"::YES
+dave::cat /var/log/daemon.log::sending attribute certificate issued by \"C=CH, O=strongSwan Project, CN=strongSwan Attribute Authority\"::YES
-dave::cat /var/log/daemon.log::sending attribute certificate issued by \"C=CH, O=Linux strongSwan, CN=expired AA\"::YES
+dave::cat /var/log/daemon.log::sending attribute certificate issued by \"C=CH, O=strongSwan Project, CN=strongSwan Legacy AA\"::YES
 dave::cat /var/log/daemon.log::received AUTHENTICATION_FAILED notify error::YES
 carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
 dave:: ping -c 1 -W 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::NO

testing/tests/ikev2/acert-inline/posttest.dat

@@ -7,7 +7,7 @@ dave::iptables-restore < /etc/iptables.flush
 carol::rm /etc/ipsec.d/acerts/carol-sales.pem
 dave::rm /etc/ipsec.d/acerts/dave-expired-aa.pem
 dave::rm /etc/ipsec.d/acerts/dave-marketing.pem
-moon::rm /etc/ipsec.d/private/aa-expired.pem
+moon::rm /etc/ipsec.d/private/aaKey-expired.pem
-moon::rm /etc/ipsec.d/private/aa.pem
+moon::rm /etc/ipsec.d/private/aaKey.pem
-moon::rm /etc/ipsec.d/aacerts/aa-expired.pem
+moon::rm /etc/ipsec.d/aacerts/aaCert-expired.pem
-moon::rm /etc/ipsec.d/aacerts/aa.pem
+moon::rm /etc/ipsec.d/aacerts/aaCert.pem

testing/tests/ikev2/acert-inline/reissue.txt

@@ -1,23 +0,0 @@
-# Carols sales acert
-pki --acert \
-	--issuercert hosts/moon/etc/ipsec.d/aacerts/aa.pem \
-	--issuerkey hosts/moon/etc/ipsec.d/private/aa.pem --in \
-	../../../hosts/carol/etc/ipsec.d/certs/carolCert.pem \
-	--group sales -l 87600 -f pem \
-	> hosts/carol/etc/ipsec.d/acerts/carol-sales.pem
-
-# Daves marketing acert
-pki --acert \
-	--issuercert hosts/moon/etc/ipsec.d/aacerts/aa.pem \
-	--issuerkey hosts/moon/etc/ipsec.d/private/aa.pem \
-	--in ../../../hosts/dave/etc/ipsec.d/certs/daveCert.pem \
-	--group marketing -l 87600 -f pem
-	> hosts/dave/etc/ipsec.d/acerts/dave-marketing.pem
-
-# Daves sales acert from expired AA
-pki --acert \
-	--issuercert hosts/moon/etc/ipsec.d/aacerts/aa-expired.pem \
-	--issuerkey hosts/moon/etc/ipsec.d/private/aa-expired.pem \
-	--in ../../../hosts/dave/etc/ipsec.d/certs/daveCert.pem \
-	--group sales -l 87600 -f pem \
-	> hosts/dave/etc/ipsec.d/acerts/dave-expired-aa.pem

testing/tests/ikev2/any-interface/hosts/bob/etc/ipsec.conf

@@ -16,7 +16,7 @@ conn %default
 	left=%any
 	leftcert=bobCert.pem
 
-conn sun 
+conn sun
 	right=PH_IP_SUN1
-	rightid="C=CH, O=Linux strongSwan, CN=sun.strongswan.org"
+	rightid="C=CH, O=strongSwan Project, CN=sun.strongswan.org"
 	auto=route

testing/tests/ikev2/any-interface/hosts/moon/etc/ipsec.conf

@@ -18,10 +18,10 @@ conn %default
 
 conn alice
 	right=PH_IP_ALICE
-	rightid="C=CH, O=Linux strongSwan, OU=Sales, [email protected]"
+	rightid="C=CH, O=strongSwan Project, OU=Sales, [email protected]"
 	auto=route
 
-conn sun 
+conn sun
 	right=PH_IP_SUN
-	rightid="C=CH, O=Linux strongSwan, CN=sun.strongswan.org"
+	rightid="C=CH, O=strongSwan Project, CN=sun.strongswan.org"
 	auto=route

testing/tests/ikev2/crl-ldap/hosts/carol/etc/ipsec.conf

@@ -6,7 +6,7 @@ config setup
 
 ca strongswan
 	cacert=strongswanCert.pem
-	crluri="ldap://ldap.strongswan.org/cn=strongSwan Root CA, o=Linux strongSwan, c=CH?certificateRevocationList"
+	crluri="ldap://ldap.strongswan.org/cn=strongSwan Root CA, o=strongSwan Project, c=CH?certificateRevocationList"
 	auto=add
 
 conn %default

testing/tests/ikev2/crl-ldap/hosts/moon/etc/ipsec.conf

@@ -6,7 +6,7 @@ config setup
 
 ca strongswan
 	cacert=strongswanCert.pem
-	crluri="ldap://ldap.strongswan.org/cn=strongSwan Root CA, o=Linux strongSwan, c=CH?certificateRevocationList"
+	crluri="ldap://ldap.strongswan.org/cn=strongSwan Root CA, o=strongSwan Project, c=CH?certificateRevocationList"
 	auto=add
 
 conn %default

testing/tests/ikev2/crl-revoked/hosts/carol/etc/ipsec.conf

@@ -11,7 +11,7 @@ conn %default
 
 conn home
 	left=PH_IP_CAROL
-	leftcert=carolRevokedCert.pem
+	leftcert=carolCert.pem
 	[email protected]
 	right=PH_IP_MOON
 	rightsubnet=10.1.0.0/16

testing/tests/ikev2/crl-revoked/hosts/carol/etc/ipsec.secrets

@@ -1,3 +1,3 @@
 # /etc/ipsec.secrets - strongSwan IPsec secrets file
 
-: RSA carolRevokedKey.pem
+: RSA carolKey.pem

testing/tests/ikev2/crl-revoked/posttest.dat

@@ -1,4 +1,2 @@
 moon::ipsec stop
 carol::ipsec stop
-carol::rm /etc/ipsec.d/private/*
-carol::rm /etc/ipsec.d/certs/*

testing/tests/ikev2/crl-to-cache/evaltest.dat

@@ -1,4 +1,4 @@
 moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*[email protected]::YES
 carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*[email protected].*moon.strongswan.org::YES
-moon:: cat /var/log/daemon.log::written crl .*/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl::YES
+moon:: cat /var/log/daemon.log::written crl .*/etc/ipsec.d/crls/.*.crl::YES
-carol::cat /var/log/daemon.log::written crl .*/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl::YES
+carol::cat /var/log/daemon.log::written crl .*/etc/ipsec.d/crls/.*.crl::YES

testing/tests/ikev2/multi-level-ca-ldap/hosts/carol/etc/ipsec.conf

@@ -5,7 +5,7 @@ config setup
 
 ca strongswan
         cacert=strongswanCert.pem
-        crluri="ldap://ldap.strongswan.org/cn=strongSwan Root CA, o=Linux strongSwan, c=CH?certificateRevocationList"
+        crluri="ldap://ldap.strongswan.org/cn=strongSwan Root CA, o=strongSwan Project, c=CH?certificateRevocationList"
         auto=add
 
 conn %default
@@ -18,12 +18,12 @@ conn %default
 	leftcert=carolCert.pem
 	right=PH_IP_MOON
 	[email protected]
-	rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
+	rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"
 
 conn alice
 	rightsubnet=PH_IP_ALICE/32
 	auto=add
-	
+
 conn venus
 	rightsubnet=PH_IP_VENUS/32
 	auto=add

testing/tests/ikev2/multi-level-ca-ldap/hosts/dave/etc/ipsec.conf

@@ -5,7 +5,7 @@ config setup
 
 ca strongswan
 	cacert=strongswanCert.pem
-	crluri="ldap://ldap.strongswan.org/cn=strongSwan Root CA, o=Linux strongSwan, c=CH?certificateRevocationList"
+	crluri="ldap://ldap.strongswan.org/cn=strongSwan Root CA, o=strongSwan Project, c=CH?certificateRevocationList"
 	auto=add
 
 conn %default
@@ -18,12 +18,12 @@ conn %default
 	leftcert=daveCert.pem
 	right=PH_IP_MOON
 	[email protected]
-	rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
+	rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"
 
 conn alice
 	rightsubnet=PH_IP_ALICE/32
 	auto=add
-	
+
 conn venus
 	rightsubnet=PH_IP_VENUS/32
 	auto=add

testing/tests/ikev2/multi-level-ca-ldap/hosts/moon/etc/ipsec.conf

@@ -5,19 +5,19 @@ config setup
 
 ca strongswan
 	cacert=strongswanCert.pem
-	crluri="ldap://ldap.strongswan.org/cn=strongSwan Root CA, o=Linux strongSwan, c=CH?certificateRevocationList"
+	crluri="ldap://ldap.strongswan.org/cn=strongSwan Root CA, o=strongSwan Project, c=CH?certificateRevocationList"
 	auto=add
 
-ca research 
+ca research
         cacert=researchCert.pem
-	crluri="ldap://ldap.strongswan.org/cn=Research CA, ou=Research, o=Linux strongSwan, c=CH?certificateRevocationList"
+	crluri="ldap://ldap.strongswan.org/cn=Research CA, ou=Research, o=strongSwan Project, c=CH?certificateRevocationList"
 	auto=add
-	
+
-ca sales 
+ca sales
         cacert=salesCert.pem
-	crluri="ldap://ldap.strongswan.org/cn=Sales CA, ou=Sales, o=Linux strongSwan, c=CH?certificateRevocationList"
+	crluri="ldap://ldap.strongswan.org/cn=Sales CA, ou=Sales, o=strongSwan Project, c=CH?certificateRevocationList"
 	auto=add
-			
+
 conn %default
 	ikelifetime=60m
 	keylife=20m
@@ -32,11 +32,11 @@ conn %default
 conn alice
 	leftsubnet=PH_IP_ALICE/32
 	right=%any
-	rightca="C=CH, O=Linux strongSwan, OU=Research, CN=Research CA"
+	rightca="C=CH, O=strongSwan Project, OU=Research, CN=Research CA"
 	auto=add
-	
+
 conn venus
 	leftsubnet=PH_IP_VENUS/32
 	right=%any
-	rightca="C=CH, O=Linux strongSwan, OU=Sales, CN=Sales CA"
+	rightca="C=CH, O=strongSwan Project, OU=Sales, CN=Sales CA"
 	auto=add

testing/tests/ikev2/multi-level-ca-revoked/hosts/carol/etc/ipsec.conf

@@ -17,5 +17,5 @@ conn home
 	right=PH_IP_MOON
 	rightsubnet=10.1.0.0/16
 	[email protected]
-	rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
+	rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"
 	auto=add

testing/tests/ikev2/multi-level-ca-revoked/hosts/moon/etc/ipsec.conf

@@ -3,11 +3,6 @@
 config setup
 	strictcrlpolicy=yes
 
-ca strongswan
-	cacert=strongswanCert.pem
-	crluri=http://crl.strongswan.org/strongswan.crl
-	auto=add
-
 conn %default
 	ikelifetime=60m
 	keylife=20m
@@ -21,5 +16,5 @@ conn %default
 conn alice
 	leftsubnet=PH_IP_ALICE/32
 	right=%any
-	rightca="C=CH, O=Linux strongSwan, OU=Research, CN=Research CA"
+	rightca="C=CH, O=strongSwan Project, OU=Research, CN=Research CA"
 	auto=add

testing/tests/ikev2/multi-level-ca-skipped/hosts/carol/etc/ipsec.conf

@@ -17,5 +17,5 @@ conn home
 	right=PH_IP_MOON
 	rightsubnet=10.1.0.0/16
 	[email protected]
-	rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
+	rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"
 	auto=add

testing/tests/ikev2/multi-level-ca-skipped/hosts/moon/etc/ipsec.conf

@@ -3,11 +3,6 @@
 config setup
 	strictcrlpolicy=yes
 
-ca strongswan
-	cacert=strongswanCert.pem
-	crluri=http://crl.strongswan.org/not-available.crl
-	auto=add
-
 conn %default
 	ikelifetime=60m
 	keylife=20m
@@ -21,5 +16,5 @@ conn %default
 conn alice
 	leftsubnet=PH_IP_ALICE/32
 	right=%any
-	rightca="C=CH, O=Linux strongSwan, OU=Research, CN=Research CA"
+	rightca="C=CH, O=strongSwan Project, OU=Research, CN=Research CA"
 	auto=add

testing/tests/ikev2/multi-level-ca-strict/hosts/carol/etc/ipsec.conf

@@ -14,12 +14,12 @@ conn %default
 	leftsendcert=ifasked
 	right=PH_IP_MOON
 	[email protected]
-	rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
+	rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"
 
 conn alice
 	rightsubnet=PH_IP_ALICE/32
 	auto=add
-	
+
 conn venus
 	rightsubnet=PH_IP_VENUS/32
 	auto=add

testing/tests/ikev2/multi-level-ca-strict/hosts/dave/etc/ipsec.conf

@@ -14,12 +14,12 @@ conn %default
 	leftsendcert=ifasked
 	right=PH_IP_MOON
 	[email protected]
-	rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
+	rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"
 
 conn alice
 	rightsubnet=PH_IP_ALICE/32
 	auto=add
-	
+
 conn venus
 	rightsubnet=PH_IP_VENUS/32
 	auto=add

testing/tests/ikev2/multi-level-ca-strict/hosts/moon/etc/ipsec.conf

@@ -22,11 +22,11 @@ conn %default
 conn alice
 	leftsubnet=PH_IP_ALICE/32
 	right=%any
-	rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
+	rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"
 	auto=add
-	
+
 conn venus
 	leftsubnet=PH_IP_VENUS/32
 	right=%any
-	rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
+	rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"
 	auto=add

testing/tests/ikev2/multi-level-ca/hosts/moon/etc/ipsec.conf

@@ -2,11 +2,6 @@
 
 config setup
 
-ca strongswan
-	cacert=strongswanCert.pem
-	crluri=http://crl.strongswan.org/strongswan.crl
-	auto=add
-
 conn %default
 	ikelifetime=60m
 	keylife=20m
@@ -21,11 +16,11 @@ conn %default
 conn alice
 	leftsubnet=PH_IP_ALICE/32
 	right=%any
-	rightca="C=CH, O=Linux strongSwan, OU=Research, CN=Research CA"
+	rightca="C=CH, O=strongSwan Project, OU=Research, CN=Research CA"
 	auto=add
-	
+
 conn venus
 	leftsubnet=PH_IP_VENUS/32
 	right=%any
-	rightca="C=CH, O=Linux strongSwan, OU=Sales, CN=Sales CA"
+	rightca="C=CH, O=strongSwan Project, OU=Sales, CN=Sales CA"
 	auto=add

testing/tests/ikev2/net2net-fragmentation/hosts/moon/etc/strongswan.conf

@@ -3,5 +3,5 @@
 charon {
   load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
 
-  fragment_size = 1024
+  fragment_size = 1088
 }

testing/tests/ikev2/net2net-fragmentation/hosts/sun/etc/strongswan.conf

@@ -3,5 +3,5 @@
 charon {
   load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
 
-  fragment_size = 1024
+  fragment_size = 1088
 }

testing/tests/ikev2/net2net-pubkey/hosts/moon/etc/ipsec.conf

@@ -13,12 +13,12 @@ conn net-net
 	left=PH_IP_MOON
 	leftsubnet=10.1.0.0/16
 	[email protected]
-	leftsigkey=moonPub.der
+	leftsigkey=moonPub.pem
 	leftauth=pubkey
 	leftfirewall=yes
 	right=PH_IP_SUN
 	rightsubnet=10.2.0.0/16
 	[email protected]
-	rightsigkey=sunPub.der
+	rightsigkey=sunPub.pem
 	rightauth=pubkey
 	auto=add

testing/tests/ikev2/net2net-pubkey/hosts/moon/etc/ipsec.secrets

@@ -1,3 +0,0 @@
-# /etc/ipsec.secrets - strongSwan IPsec secrets file
-
-: RSA moonKey.der

testing/tests/ikev2/net2net-pubkey/hosts/sun/etc/ipsec.conf

@@ -13,10 +13,10 @@ conn net-net
 	left=PH_IP_SUN
 	leftsubnet=10.2.0.0/16
 	[email protected]
-	leftsigkey=sunPub.der
+	leftsigkey=sunPub.pem
 	leftfirewall=yes
 	right=PH_IP_MOON
 	rightsubnet=10.1.0.0/16
 	[email protected]
-	rightsigkey=moonPub.der
+	rightsigkey=moonPub.pem
 	auto=add

testing/tests/ikev2/net2net-pubkey/hosts/sun/etc/ipsec.secrets

@@ -1,3 +0,0 @@
-# /etc/ipsec.secrets - strongSwan IPsec secrets file
-
-: RSA sunKey.der

testing/tests/ikev2/ocsp-local-cert/hosts/winnetou/etc/ca/ocsp/ocsp.cgi

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-cd /etc/openssl
+cd /etc/ca
 
 echo "Content-type: application/ocsp-response"
 echo ""

testing/tests/ikev2/ocsp-multi-level/hosts/moon/etc/ipsec.conf

@@ -31,11 +31,11 @@ conn %default
 conn alice
 	leftsubnet=PH_IP_ALICE/32
 	right=%any
-	rightca="C=CH, O=Linux strongSwan, OU=Research, CN=Research CA"
+	rightca="C=CH, O=strongSwan Project, OU=Research, CN=Research CA"
 	auto=add
-	
+
 conn venus
 	leftsubnet=PH_IP_VENUS/32
 	right=%any
-	rightca="C=CH, O=Linux strongSwan, OU=Sales, CN=Sales CA"
+	rightca="C=CH, O=strongSwan Project, OU=Sales, CN=Sales CA"
 	auto=add

testing/tests/ikev2/ocsp-multi-level/pretest.dat

@@ -4,5 +4,7 @@ dave::ipsec start
 moon::expect-connection alice
 carol::expect-connection alice
 carol::ipsec up alice
+carol::ipsec up venus
 dave::expect-connection venus
 dave::ipsec up venus
+dave::ipsec up alice

testing/tests/ikev2/ocsp-no-signer-cert/hosts/winnetou/etc/ca/ocsp/ocsp.cgi

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-cd /etc/openssl
+cd /etc/ca
 
 echo "Content-type: application/ocsp-response"
 echo ""

testing/tests/ikev2/ocsp-revoked/hosts/carol/etc/ipsec.conf

@@ -15,7 +15,7 @@ conn %default
 	rekeymargin=3m
 	keyingtries=1
 	left=PH_IP_CAROL
-	leftcert=carolRevokedCert.pem
+	leftcert=carolCert.pem
 	[email protected]
 
 conn home

testing/tests/ikev2/ocsp-revoked/hosts/carol/etc/ipsec.secrets

@@ -1,3 +1,3 @@
 # /etc/ipsec.secrets - strongSwan IPsec secrets file
 
-: RSA carolRevokedKey.pem
+: RSA carolKey.pem

testing/tests/ikev2/ocsp-revoked/posttest.dat

@@ -1,4 +1,2 @@
 moon::ipsec stop
 carol::ipsec stop
-carol::rm /etc/ipsec.d/private/*
-carol::rm /etc/ipsec.d/certs/*

testing/tests/ikev2/ocsp-signer-cert/hosts/carol/etc/ipsec.conf

@@ -15,7 +15,7 @@ conn %default
 	rekeymargin=3m
 	keyingtries=1
 	left=PH_IP_CAROL
-	leftcert=carolCert-ocsp.pem
+	leftcert=carolCert.pem
 	[email protected]
 
 conn home

testing/tests/ikev2/ocsp-signer-cert/hosts/carol/etc/ipsec.secrets

@@ -1,3 +1,3 @@
 # /etc/ipsec.secrets - strongSwan IPsec secrets file
 
-: RSA carolKey-ocsp.pem
+: RSA carolKey.pem

testing/tests/ikev2/ocsp-signer-cert/posttest.dat

@@ -1,4 +1,2 @@
 moon::ipsec stop
 carol::ipsec stop
-carol::rm /etc/ipsec.d/certs/*
-carol::rm /etc/ipsec.d/private/*

testing/tests/ikev2/ocsp-strict-ifuri/hosts/carol/etc/ipsec.conf

@@ -10,14 +10,14 @@ conn %default
 	keyingtries=1
 	keyexchange=ikev2
 	left=PH_IP_CAROL
-	leftcert=carolCert-ifuri.pem
+	leftcert=carolCert.pem
 	right=PH_IP_MOON
 	[email protected]
 
 conn alice
 	rightsubnet=PH_IP_ALICE/32
 	auto=add
-	
+
 conn venus
 	rightsubnet=PH_IP_VENUS/32
 	auto=add

testing/tests/ikev2/ocsp-strict-ifuri/hosts/dave/etc/ipsec.conf

@@ -2,7 +2,7 @@
 
 config setup
 	strictcrlpolicy=ifuri
-	
+
 conn %default
 	ikelifetime=60m
 	keylife=20m
@@ -10,14 +10,14 @@ conn %default
 	keyingtries=1
 	keyexchange=ikev2
 	left=PH_IP_DAVE
-	leftcert=daveCert-ifuri.pem
+	leftcert=daveCert.pem
 	right=PH_IP_MOON
 	[email protected]
 
 conn alice
 	rightsubnet=PH_IP_ALICE/32
 	auto=add
-	
+
 conn venus
 	rightsubnet=PH_IP_VENUS/32
 	auto=add

testing/tests/ikev2/ocsp-strict-ifuri/hosts/moon/etc/ipsec.conf

@@ -16,11 +16,11 @@ conn %default
 conn alice
 	leftsubnet=PH_IP_ALICE/32
 	right=%any
-	rightca="C=CH, O=Linux strongSwan, OU=Research, CN=Research CA"
+	rightca="C=CH, O=strongSwan Project, OU=Research, CN=Research CA"
 	auto=add
-	
+
 conn venus
 	leftsubnet=PH_IP_VENUS/32
 	right=%any
-	rightca="C=CH, O=Linux strongSwan, OU=Sales, CN=Sales CA"
+	rightca="C=CH, O=strongSwan Project, OU=Sales, CN=Sales CA"
 	auto=add

testing/tests/ikev2/ocsp-timeouts-good/hosts/carol/etc/ipsec.conf

@@ -8,7 +8,7 @@ ca strongswan-ca
         ocspuri1=http://bob.strongswan.org:8800
 	ocspuri2=http://ocsp.strongswan.org:8880
 	auto=add
-			
+
 conn %default
 	keyexchange=ikev2
 	ikelifetime=60m
@@ -16,7 +16,7 @@ conn %default
 	rekeymargin=3m
 	keyingtries=1
 	left=PH_IP_CAROL
-	leftcert=carolCert-ocsp.pem
+	leftcert=carolCert.pem
 	[email protected]
 
 conn home

testing/tests/ikev2/ocsp-timeouts-good/hosts/carol/etc/ipsec.secrets

@@ -1,3 +1,3 @@
 # /etc/ipsec.secrets - strongSwan IPsec secrets file
 
-: RSA carolKey-ocsp.pem
+: RSA carolKey.pem