Home / server / Questions / 529814
Accepted
Evan Carroll
Asked: 2013-08-10 01:41:35 +0800 CST

StrongSwan outputs in log "certificate status is not available"

  • 772

Wha does the warning certificate status is not available in charon.log mean?

16[CFG] certificate status is not available
16[CFG]   reached self-signed root ca with a path length of 0

Everything works, I just want to understand what it means.

strongswan

1 Answers

  1. Best Answer

    It means that strongSwan was not able to verify the status of the certificate with either a Certificate Revocation List (CRL) or via the Online Certificate Status Protocol (OCSP). Both methods can be used to revoke previously issued certificates. If strictcrlpolicy in ipsec.conf is set to yes or ifuri strongSwan will only accept certificates if the status has been verified, the default is no so you will just get this log message.

    If you want to use one or both of these methods you have to create a CRL or setup an OCSP server and then either configure the CRL or OCSP URIs in a ca section in ipsec.conf, or make sure your certificates contain the URIs in CRL Distribution Point or Authority Information Access X.509 extensions. For smaller setups this is usually not required, though.

    • 7