diff options
| author | Christian Breunig <christian@breunig.cc> | 2024-04-12 17:19:43 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-04-12 17:19:43 +0200 |
| commit | 28983d57e6d18c8d6564c8d72f253618451e5a41 (patch) | |
| tree | 4083b8c4c78e1d8ed387fb1df33c043c6fe67a1d /data | |
| parent | 6a0dfc279a7f64e0ce5c2ea9269ba5826d255aaf (diff) | |
| parent | 7100a5797bce50678be6bb001d4d847b26ff9eca (diff) | |
| download | vyos-1x-28983d57e6d18c8d6564c8d72f253618451e5a41.tar.gz vyos-1x-28983d57e6d18c8d6564c8d72f253618451e5a41.zip | |
Merge pull request #3298 from vyos/mergify/bp/sagitta/pr-2708
T5871: ipsec remote access VPN: specify "cacerts" for client auth (backport #2708)
Diffstat (limited to 'data')
| -rw-r--r-- | data/templates/ipsec/swanctl/remote_access.j2 | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/data/templates/ipsec/swanctl/remote_access.j2 b/data/templates/ipsec/swanctl/remote_access.j2 index af7f2994e..adfa32bde 100644 --- a/data/templates/ipsec/swanctl/remote_access.j2 +++ b/data/templates/ipsec/swanctl/remote_access.j2 @@ -35,6 +35,11 @@ auth = {{ rw_conf.authentication.client_mode }} eap_id = %any {% endif %} +{% if rw_conf.authentication.client_mode is vyos_defined('eap-tls') or rw_conf.authentication.client_mode is vyos_defined('x509') %} +{# pass all configured CAs as filenames, separated by commas #} +{# this will produce a string like "MyCA1.pem,MyCA2.pem" #} + cacerts = {{ '.pem,'.join(rw_conf.authentication.x509.ca_certificate) ~ '.pem' }} +{% endif %} } children { ikev2-vpn { |