Return to description.txt CVS log

Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / strongswan / testing / tests / ikev2 / ocsp-strict-ifuri

Annotation of embedaddon/strongswan/testing/tests/ikev2/ocsp-strict-ifuri/description.txt, revision 1.1

1.1     ! misho       1: This scenario tests the <b>strictcrlpolicy=ifuri</b> option which enforces a
        !             2: strict CRL policy for a given CA if at least one OCSP or CRL URI is known
        !             3: for this CA at the time of the certificate trust path verification.
        !             4: On the gateway <b>moon</b> two different Intermediate CAs control the access
        !             5: to the hosts <b>alice</b> and <b>venus</b>. Access to <b>alice</b> is granted
        !             6: to users presenting a certificate issued by the Research CA whereas <b>venus</b>
        !             7: can only be reached with a certificate issued by the Sales CA. 
        !             8: <p>
        !             9: The roadwarrior <b>carol</b> has a certificate from the Research CA which does not
        !            10: contain any URIs. Therefore a strict CRL policy is <b>not</b> enforced and the
        !            11: connection setup succeeds, although the certificate status is unknown.
        !            12: </p>
        !            13: <p>
        !            14: The roadwarrior <b>dave</b> has a certificate from the Sales CA which contains
        !            15: a single OCSP URI but which is not resolvable. Thus because of  the known URI
        !            16: a strict CRL policy is enforced and the unknown certificate status causes the
        !            17: connection setup to fail.
        !            18: </p>