[strongSwan] leftcert ikev2

[Markus Maurer]

Hi,
can anybody explain me why leftcert is needed in ikev2? What is it used for? I couldn't find an explanation about it.

Thanks in advance!

[bls s]

I’m using the new swanctl strongSwan support, but I’m pretty sure that the certs item in a connection’s local description is the same as leftcert.

My understanding is that the cert is used by the client to validate that it’s talking to the server that it thinks it connected to. Obviously the CA can be validated. Windows and iOS clients also validate against the altNames to provide an extra level of assurance. Windows checks that the hostname it connected to is one of the altNames, and iOS checks that the RemoteID in the VPN configuration is one of the altNames.

Not sure about MacOS and Android (yet), but they are undoubtedly similar.

From: Markus Maurer<mailto:***@v-net.tk>
Sent: Tuesday, October 23, 2018 7:16 AM
To: ***@lists.strongswan.org<mailto:***@lists.strongswan.org>
Subject: [strongSwan] leftcert ikev2

Hi,
can anybody explain me why leftcert is needed in ikev2? What is it used for? I couldn't find an explanation about it.

Thanks in advance!


--
This email was Malware checked by UTM 9. http://www.sophos.com

[Markus Maurer]

Hello,

thank you very much guys.

Best regards

Am Dienstag, Oktober 23, 2018 19:39 CEST, bls s <***@outlook.com> schrieb:
  
I’m using the new swanctl strongSwan support, but I’m pretty sure that the certs item in a connection’s local description is the same as leftcert.

 
My understanding is that the cert is used by the client to validate that it’s talking to the server that it thinks it connected to. Obviously the CA can be validated. Windows and iOS clients also validate against the altNames to provide an extra level of assurance. Windows checks that the hostname it connected to is one of the altNames, and iOS checks that the RemoteID in the VPN configuration is one of the altNames.

 
Not sure about MacOS and Android (yet), but they are undoubtedly similar.

 
From: Markus Maurer
Sent: Tuesday, October 23, 2018 7:16 AM
To: ***@lists.strongswan.org
Subject: [strongSwan] leftcert ikev2

 Hi,
can anybody explain me why leftcert is needed in ikev2? What is it used for? I couldn't find an explanation about it.

Thanks in advance!--
This email was Malware checked by UTM 9. http://www.sophos.com--
This email was Malware checked by UTM 9. http://www.sophos.com