Re: [Design] Re: [Users] multiple ipsec.secrets entries

Michael Richardson wrote:
> Andreas> parameter. Since X.509-1.1.6 for freeswan-2.00

Excerpt from the "Installation and Configuration Guide" for X.509-1.x.x:

1. Using the patch with OpenPGP certificates

   ---

The X.509 patch also supports RSA based authentication using OpenPGP certificates and OpenPGP V3 fingerprints used as a KEY_ID identifier.

12.1 OpenPGP certificates

OpenPGP certificates containing RSA public keys can now directly be loaded in ASCII armored PGP format using the leftcert and rightcert parameters in /etc/ipsec.conf:

   conn pgp

        right=%any
        righcert=peerCert.asc
        left=%defaultroute
        leftcert=gatewayCert.asc

The peer certificate must be stored locally (the default directory is /etc/ipsec.d/certs) since currently no trust can be established for PGP certificates received from a peer via the IKE protocol.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related lists.freeswan.org Links 1998-fall 1998-spring 1998-summer 1998-winter 1999-winter announce briefs bugs design freeswan-list hipsec ietf-sectest users users-admin Request more information about Pantek

12.2 OpenPGP private keys

PGP private keys in unencrypted form can now directly be loaded in ASCII armored PGP format via an entry in /etc/ipsec.secrets:

   : RSA gatewayKey.asc

At the time being "legacy" RSA keys as used by PGP 2.6.x are supported. But if there is a demand for it I could implement OpenPGP V4 keys as used by GnuPG with little additional effort.

Regards

Andreas

Andreas Steffen                   e-mail: andreas.steffen@strongsec.com
strongSec GmbH                    home:   
http://www.strongsec.com
Alter Zürichweg 20                phone:  +41 1 730 80 64

==========================================[strong internet security]===

Content Security by MailMarshal