Peter Müller 993724b4dd vpnmain.cgi: set SubjectAlternativeName default during root certificate generation ...

Some IPsec implementations such as OpenIKED require SubjectAlternativeName
data on certificates and refuse to establish connections otherwise.

The StrongSwan project also recommends it (see:
https://wiki.strongswan.org/projects/strongswan/wiki/SimpleCA) although
it is currently not enforced by their IPsec software.

For convenience purposes and to raise awareness, this patch adds a default
SubjectAlternativeName based on the machines hostname or IP address. Existing
certificates remain unchanged for obvious reasons.

The third version of this patch fixes a duplicate DNS query reported by Michael.

Fixes #11594

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Cc: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

2020-01-11 14:15:28 +00:00

..

cgi-bin

vpnmain.cgi: set SubjectAlternativeName default during root certificate generation

2020-01-11 14:15:28 +00:00

html

embed background image in redirect template

2018-09-10 16:30:09 +01:00