Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Wha does the warning certificate status is not available in charon.log mean?

16[CFG] certificate status is not available
16[CFG]   reached self-signed root ca with a path length of 0

Everything works, I just want to understand what it means.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

It means that strongSwan was not able to verify the status of the certificate with either a Certificate Revocation List (CRL) or via the Online Certificate Status Protocol (OCSP). Both methods can be used to revoke previously issued certificates. If strictcrlpolicy in ipsec.conf is set to yes or ifuri strongSwan will only accept certificates if the status has been verified, the default is no so you will just get this log message.

If you want to use one or both of these methods you have to create a CRL or setup an OCSP server and then either configure the CRL or OCSP URIs in a ca section in ipsec.conf, or make sure your certificates contain the URIs in CRL Distribution Point or Authority Information Access X.509 extensions. For smaller setups this is usually not required, though.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.