On 2017-05-07 18:04, Paul Suh wrote:
Have you tried using the DNS names in your ipsec.conf, and in the filenames in the /etc/isakmpd/certs directory? Generally, certificates are applied against the DNS name for servers, rather than the IP address. Maybe a bug in isakmpd or one of the other hosts that doesn't handle IP addresses in the SAN field correctly since it's such a rare usage?
Thanks for the idea, but it appears ipsecctl converts names to IP addresses before configuring isakmpd.
