[strongSwan] OCSP - no signer certificate found

[Markus P. Beckhaus]

Dear all,

I have set up strongswan to user OCSP as well as CRLs. Both parts are running fine and are reporting certificates as valid.

However, I do have one issue with OCSP checking and that is the abovementioned message “no signer certificate”.

I can add our OCSP signer certificate to /etc/ipsec.d/ocspcerts, but in our case the OCSP signer cert is being renewed in very short intervals, because the signer cert contains the id-pkix-ocsp-nocheck extension.

Any idea how to solve this?

Best Regards