I'm looking for a way to limit the certs that my IPsec can accept. I'm using StrongSwan (swanctl version 5.7), I want to accept only certs coming from a remote with a name of yoji.*.example.com

I searched a lot on the internet. The documentation does not give any solution except modify on the client-side, which I'm not able to do at the moment.

I found something called Cert_Policy but I didn't understand how to apply it, I don't understand how it can help or how to use it.

Can someone help me with this? Or if you have a solution or a modification to modify on the config file that I could try it would be much appreciated!

1 Answer 1


The cert_policy constraint (swanctl.conf) enforces specific OIDs in a certificate's certificate policies extension, so that might not be what you are looking for.

As for matching identities with wildcards, strongSwan currently only allows ignoring complete RDNs (not parts of them), for instance, C=CH, O=strongSwan, CN=* (multiple RDNs may be ignored). With domain names and email addresses (e.g. in subjectAltName extensions of type dNSName/rfc822Name), only prefixes can be ignored (e.g. *.strongswan.org, or *@strongswan.org).

  • Thanks for your reply, however we cannot use the wildcard on the certificate, please refer to: wiki.strongswan.org/projects/strongswan/wiki/… tools.ietf.org/html/rfc6125#section-7.2 Therefore we can only use wildcard for the whole certificate name not for a partial of it's domain like "*.test.com" which is not allowed based on the docs that I linked before
    – Sehnani
    Commented Mar 23, 2020 at 14:27
  • I was not referring to using a wildcard in the certificates but matching identities in the certificates (subject DN or SANs) against wildcards in the config, which is presumably what you wanted to do in the first place.
    – ecdsa
    Commented Mar 23, 2020 at 14:33
  • Sorry, I did not understand, can you elaborate more ? How can I match the identities in the certificates subject DN or SANs against wildcards in the config? and if it possible I want to learn more about this, if it is possible to send me some useful links? Thanks in advance
    – Sehnani
    Commented Mar 23, 2020 at 16:02
  • Exactly as I suggested in the examples in my answer. If you configure such a value as remote identity, only certificates with a matching identity will be accepted. It's actually documented for connections.<conn>.remote<suffix>.id in the swanctl.conf docs. You can find several examples of this within the strongSwan test scenarios (the most obvious is probably ikev2/wildcards, it uses the legacy config interface, but can easily be adapted to swanctl.conf).
    – ecdsa
    Commented Mar 23, 2020 at 16:43
  • the wildcard that is mentioned in the documentation refers to the whole certificate, I want that the tunnel goes up only if my remote certificate respect some criteria : for example it end with test.com what you just suggest did not work and it only works with "*" stand alone you cannot have other characteristic or word with the wildcard, either the wildcard either the full name of the certificate
    – Sehnani
    Commented Mar 23, 2020 at 16:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .