strongSwan

Hi,

While setting up a strongswan with our certs, I do see in the logs:

05[TLS] received TLS peer certificate 'C=DE, L=Stuttgart, O=Universitaet Stuttgart, OU=NKS, CN=Kilian Krause'
05[TLS] received TLS intermediate certificate 'C=DE, L=Stuttgart, O=Universitaet Stuttgart, CN=Universitaet Stuttgart CA - G01, E=ca-g01@uni-stuttgart.de'
05[TLS] received TLS intermediate certificate 'C=DE, O=DFN-Verein, OU=DFN-PKI, CN=DFN-Verein PCA Global - G01'
05[TLS] received TLS intermediate certificate 'C=DE, O=Deutsche Telekom AG, OU=T-TeleSec Trust Center, CN=Deutsche Telekom Root CA 2'
05[CFG] using certificate "C=DE, L=Stuttgart, O=Universitaet Stuttgart, OU=NKS, CN=Kilian Krause"
05[CFG] using trusted intermediate ca certificate "C=DE, L=Stuttgart, O=Universitaet Stuttgart, CN=Universitaet Stuttgart CA - G01, E=ca-g01@uni-stuttgart.de"
05[CFG] checking certificate status of "C=DE, L=Stuttgart, O=Universitaet Stuttgart, OU=NKS, CN=Kilian Krause"
05[CFG] fetching crl from 'http://cdp1.pca.dfn.de/uni-stuttgart-ca/pub/crl/cacrl.crl' ...
05[CFG] using trusted intermediate ca certificate "C=DE, O=DFN-Verein, OU=DFN-PKI, CN=DFN-Verein PCA Global - G01"
05[CFG] policy 2.5.29.32.0 missing in issuing certificate 'C=DE, O=DFN-Verein, OU=DFN-PKI, CN=DFN-Verein PCA Global - G01'
05[CFG] crl response verification failed
05[CFG] fetching crl from 'http://cdp2.pca.dfn.de/uni-stuttgart-ca/pub/crl/cacrl.crl' ...
05[CFG] using trusted intermediate ca certificate "C=DE, O=DFN-Verein, OU=DFN-PKI, CN=DFN-Verein PCA Global - G01"
05[CFG] policy 2.5.29.32.0 missing in issuing certificate 'C=DE, O=DFN-Verein, OU=DFN-PKI, CN=DFN-Verein PCA Global - G01'
05[CFG] crl response verification failed
05[CFG] certificate status is not available

...

The missing policy is the "anyPolicy", according to https://tools.ietf.org/html/rfc5280

Why exactly is this OID policy part relevant and since a child CA cannot exceed its parent CA's policy the OID policy match should implicitly be defaulted to the parent OID policy (of course unless this is a root CA). Thus in our case, there is an implicit policy that's perfectly valid for what StrongSwan wants to check.

Is there any way to work around this and ensure a proper validation of the CA and CRL/OCSP for our use case?

TIA!
Kilian