mirror of
https://github.com/strongswan/strongswan.git
synced 2025-10-06 00:00:47 -04:00
91d71abb16
To avoid considering each cached OCSP response and evaluating its trustchain, we limit the certificates considered for OCSP signing to: - The issuing CA of the checked certificate - A directly delegated signer by the same CA, having the OCSP signer constraint - Any locally installed (trusted) certificate having the OCSP signer constraint The first two options cover the requirements from RFC 6960 2.6. For compatibility with non-conforming CAs, we allow the third option as exception, but require the installation of such certificates locally.
8 lines
531 B
Plaintext
8 lines
531 B
Plaintext
moon:: cat /var/log/daemon.log::requesting ocsp status from::YES
|
|
moon:: cat /var/log/daemon.log::ocsp response verification failed, no signer::YES
|
|
moon:: cat /var/log/daemon.log::certificate status is not available::YES
|
|
moon:: cat /var/log/daemon.log::constraint check failed: RULE_CRL_VALIDATION is FAILED, but requires at least GOOD::YES
|
|
moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED::NO
|
|
carol::cat /var/log/daemon.log::received AUTHENTICATION_FAILED notify error::YES
|
|
carol::ipsec status 2> /dev/null::home.*ESTABLISHED::NO
|