<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2800.1400" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>
<DIV><FONT face=Arial size=2>Hi to the forum,</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Well, I'm still using freeswan with x509 path and I
send my question to this forum, because freeswan one is obsolete.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>My problem is the following:</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>My root CA will be soon obsolete and I want to know
if it's possible to use multiple (in fact 2) root CA in
/etc/ipsec.d/cacerts/, during a certain time (needed for the
transition).</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Is it possible?</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>If yes, I should have 2 crl.pem in
/etc/ipsec.d/clrs/. 1 crl per cacert.</FONT></DIV>
<DIV><FONT face=Arial size=2>How (freeswan/open)swan would link a
clr to a cacert?</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV>help welcomed. </DIV>
<DIV><FONT face=Arial size=2>thanks.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Laurent.</FONT></DIV></FONT></DIV></BODY></HTML>