Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to establish a LAN to LAN connection through a VPN tunnel. There's a Zywall at the remote office which will be responsible for establishing a connection to a Draytek at the main office. I'm able to establish the connection if I use shared keys, but I'd like to use certificates instead.

I've downloaded the XCA application for Ubuntu which allows me to first create a CA certificate, and then sign "certificate signing reqests" using this CA. However, I'm uncertain if I am doing things right.

More specifically<, which basic keys/extended keys should the CA certificate and the certificates themselves have? Right now I just skip selecting any keys at all, but is that right?

All hints and help appreciated!

share|improve this question

I got this to work.

The CA certificate needed the "Certificate Sign" and "CRL Sign" key usage, and the certificates (installed in the routers) needed the "Digital Signature" and "Key Encipherment" key usage.

From the routers, i generated certificate sign requests and signed them with the CA certificate i created in XCA. I then imported the signed certificates back into the routers. Furthermore, I also added the CA certificate in each of the routers as a "Trusted Certificate".

I worked very well after that.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.