[Openswan dev] ID_DER_ASN1_DN change in 2.5.17, was Re: [Openswan Users] Openswan on Fedora 9

[Michael Richardson]

The problem is that you can not use a public key from a certificate with
a different rightid=.  Once you say "rightcert=" the rightid was forced,
no choice at all.  Many people forced to use PSK because they couldn't
process a certificate.

Being forced to use the "DN" which might well be "localhost.localdomain"
if you were dealing with a *racoon* or SonicWall, or or thing that has a
self-signed certificate as the only way to get a public key out.

You get the old behaviour by leaving out rightid= (it then defaults to
%fromcert), or explicitely saying "rightid=%fromcert". 

-- 
]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] mcr at sandelman.ottawa.on.ca http://www.sandelman.ottawa.on.ca/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [