denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ocsp-strict-ifuri added

Browse Source
This commit is contained in:
Andreas Steffen
2007-04-20 14:50:42 +00:00
parent ce9b4ea6e6
commit ea4563d93f
15 changed files with 290 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/ikev2/ocsp-strict-ifuri/description.txt
+18
View File
@@ -0,0 +1,18 @@
This scenario tests the <b>strictcrlpolicy=ifuri</b> option which enforces a
strict CRL policy for a given CA if at least one OCSP or CRL URI is known
for this CA at the time of the certificate trust path verification.
On the gateway <b>moon</b> two different Intermediate CAs control the access
to the hosts <b>alice</b> and <b>venus</b>. Access to <b>alice</b> is granted
to users presenting a certificate issued by the Research CA whereas <b>venus</b>
can only be reached with a certificate issued by the Sales CA.
<p>
The roadwarrior <b>carol</b> has a certificate from the Research CA which does not
contain any URIs. Therefore a strict CRL policy is <b>not</b> enforced and the
connection setup succeeds, although the certificate status is unknown.
</p>
<p>
The roadwarrrior <b>dave</b> has a certificate from the Sales CA which contains
a single OCSP URI but which is not resolvable. Thus because of the known URI
a strict CRL policy is enforced and the unknown certificate status causes the
connection setup to fail.
</p>