Setup a simple CA¶

This How-To sets up a Certificate Authority using the strongSwan PKI tool, keeping it as simple as possible.

CA certificate¶

First, generate a private key, the default generates a 2048 bit RSA key:

ipsec pki --gen > caKey.der

For a real-world setup, make sure to keep this key private.

Now self-sign a CA certificate using the generated key:

ipsec pki --self --in caKey.der --dn "C=CH, O=strongSwan, CN=strongSwan CA" --ca > caCert.der

Adjust the distinguished name to your needs, it will be included in all issued certificates.

That's it, your CA is ready to issue certificates.

End entity certificates¶

For each peer, generate a private key and issue a certificate using your new CA:

ipsec pki --gen > peerKey.der

ipsec pki --pub --in peerKey.der | ipsec pki --issue --cacert caCert.der --cakey caKey.der 
                                             --dn "C=CH, O=strongSwan, CN=peer" > peerCert.der

The second command extracts the public key and issues a certificate using your CA. Distribute private key and certificate to your peer.

Install certificates
Certificates are stored in /etc/ipsec.d subdirectories.
Here we take the example of Moon (gateway) and Carol (peer).¶

On moon:

• /etc/ipsec.d/[fix-me]/moonKey.der holds the public key of your CA.
• /etc/ipsec.d/[fix-me/moonKey.der holds the private key of your CA.

On carol:

• /etc/ipsec.d/[fix-me]/carolKey.der holds the public key for your certificate.
• /etc/ipsec.d/[fix-me/carolKey.der holds the private key for your certificate.