I’m using the new swanctl strongSwan support, but I’m pretty sure that the certs item in a connection’s local description is the same as leftcert.
My understanding is that the cert is used by the client to validate that it’s talking to the server that it thinks it connected to. Obviously the CA can be validated. Windows and iOS clients also validate against the altNames to provide an extra level of assurance. Windows checks that the hostname it connected to is one of the altNames, and iOS checks that the RemoteID in the VPN configuration is one of the altNames. Not sure about MacOS and Android (yet), but they are undoubtedly similar. From: Markus Maurer<mailto:m...@v-net.tk> Sent: Tuesday, October 23, 2018 7:16 AM To: users@lists.strongswan.org<mailto:users@lists.strongswan.org> Subject: [strongSwan] leftcert ikev2 Hi, can anybody explain me why leftcert is needed in ikev2? What is it used for? I couldn't find an explanation about it. Thanks in advance! -- This email was Malware checked by UTM 9. http://www.sophos.com
