Using PKI tool from strongswan to setup a CA. Trying to setup the OCSP side of things have run into many issues as per another thread I posted (Strongswan PKI - ED25519 Certifcates - OCSP Responder having issues). Now I am looking at how to add stapling.

Is there a way of creating certificates with strongswan pki that use the MustStaple Extension or as the latest openssl refers to it status_request?

I can't seem to find the documentation on it nor any information on it. Can't even find out how to add extensions to the certificate with strongswan pki.


The X.509 extension you refer to is actually called "TLS feature extension" and is defined in RFC 7633. If defined, it contains a list of TLS extension identifiers of which one might be status_request. So it's quite specific to TLS.

Likewise, OCSP stapling is a feature of TLS (via its Certificate Status Request extension as defined in RFC 6066) so it's not directly applicable to IKEv2.

However, there is a similar feature defined in RFC 4806, which allows exchanging OCSP responses during IKEv2 authentication. strongSwan currently doesn't support it, though.

For these reasons the extension is currently not relevant to strongSwan, which is why the pki tool doesn't provide support for it.

| improve this answer | |
  • Okay that is unfortunate as I am trying to deploy a Ed25519 Certificate and OpenSSL wouldn't create the certificates. Is there a tool that I can use that does support it for ed25519 certificates? – shinooni May 7 '18 at 4:20
  • You could always use a newer version of OpenSSL that supports Ed25519 to generate your certificates (e.g. in a Docker container). – ecdsa May 7 '18 at 8:17
  • Is it just the docker container one? because when i built with the April 2018 release it had ed25519 as an algorithm option but not for any thing else like CA, x509, ecparam or ec. The only thing that was available to use Ed25519 for was req. Unless there was some configuration I was meant to do? to get those other commands working with ed25519 – shinooni May 7 '18 at 11:21
  • No, Docker was just a suggestion if you didn't want to mess with the OpenSSL version installed on your system. Just use a new enough version (install it on your system, use Docker, whatever...) and you should be able to use Ed25519 for the certificates (that's at least what this ticket and this related one suggest). – ecdsa May 7 '18 at 12:41
  • So below is what ive used to generate the root CA and under this comment I will add the intermediary which is where it falls apart. sudo openssl genpkey -algorithm ED25519 -out private/ca.cheese.key.pem to generate the private key for the root ca sudo openssl genpkey -algorithm ED25519 -out intermediate/private/int.cheese.key.pem to generate the private key for the intermediary sudo openssl req -config openssl_root.cnf -new -x509 -extensions v3_ca -key private/ca.cheese.key.pem -out certs/ca.cheese.crt.pemto create the root ca certificate. – shinooni May 7 '18 at 17:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.