Return to description.txt CVS log

Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / strongswan / testing / tests / ikev2 / ocsp-strict-ifuri

Strongswan

This scenario tests the <b>strictcrlpolicy=ifuri</b> option which enforces a
strict CRL policy for a given CA if at least one OCSP or CRL URI is known
for this CA at the time of the certificate trust path verification.
On the gateway <b>moon</b> two different Intermediate CAs control the access
to the hosts <b>alice</b> and <b>venus</b>. Access to <b>alice</b> is granted
to users presenting a certificate issued by the Research CA whereas <b>venus</b>
can only be reached with a certificate issued by the Sales CA. 
<p>
The roadwarrior <b>carol</b> has a certificate from the Research CA which does not
contain any URIs. Therefore a strict CRL policy is <b>not</b> enforced and the
connection setup succeeds, although the certificate status is unknown.
</p>
<p>
The roadwarrior <b>dave</b> has a certificate from the Sales CA which contains
a single OCSP URI but which is not resolvable. Thus because of  the known URI
a strict CRL policy is enforced and the unknown certificate status causes the
connection setup to fail.
</p>