0

I have a StrongSwan charon server on Ubuntu 18.04. I connect to this server with a StrongSwan charon-cmd client from another Ubuntu Linux machine.

The command I use from the client machine to connect to the server is:

charon-cmd --cert ./GoDaddyCA1.crt --cert GoDaddyCA2.crt --host xxx.example.com --identity myusername

It works great, but I don't understand why I need two "--cert" options in the command line to trust both GoDaddy CA certificates in the chain.

My personal certificate is served by the StrongSwan server, and its authority is the GoDaddyCA1.crt. The GoDaddyCA1.crt certificate has an authority of the GoDaddyCA2.crt certificate. The GoDaddyCA2.crt is a self-signed root certificate.

So, the authority chain is:

MyPersonalCert.crt -> GoDaddyCA1.crt -> GoDaddyCA2.crt

The meaning of the charon-cmd command-line option "--cert" is to declare that "this is a certificate that I trust". So, I would expect that by trusting the GoDaddyCA1.crt, then my personal certificate should also be trusted.

But that's not good enough for charon-cmd. The charon-cmd client demands that I specify "--cert" to trust all the way to a self-signed certificate. But this seems superfluous. If I trust the intermediate CA certificate, then obviously I must also trust it's authority CA cert, right?

Is this a bug, or a feature? If it's a feature, what benefit does it provide?

Improve this question

1 Answer 1

Reset to default
1

Intermediate CA certificates are currently not accepted as trust anchor in strongSwan, only self-signed root CA certificates.

If the server sends the intermediate CA certificate along with the server certificate, you only have to trust the root CA certificate (i.e. --cert GoDaddyCA2.crt will be enough). If it doesn't, make sure it's installed and check the config (e.g. send_cert in swanctl.conf). Only if that's not an option, you can't avoid having to configure both certificates on the client.

Improve this answer
3
  • Thank you for this advice. I do not have an /etc/swanctl directory in my Linux distribution (Ubuntu 18.04), and therefore I don't have a swanctl.conf file (or I don't know where it is). I have StrongSwan 5.6.2 from a few years ago, so maybe this is a new config file? Is there some configuration in 5.6.2 that is analogous, which will allow me to configure the server to send an intermediate CA certificate?
    – deltamind106
    May 23, 2022 at 13:50
  • Did you check if it's already sent? Otherwise, check the leftsendcert setting in ipsec.conf and make sure the intermediate CA certificate is installed in /etc/ipsec.d/cacerts.
    – ecdsa
    May 24, 2022 at 6:54
  • You were right, once I added the intermediate cert to the /etc/ipsec.d/cacerts directory, then it automatically sent it. So there was nothing to configure, and it works now without the client needing to trust multiple certs. Thanks!
    – deltamind106
    May 27, 2022 at 20:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .