From 0284f31bb99bbe2fad9fda9cf99d73e4fa3d2dfd Mon Sep 17 00:00:00 2001 From: Nataliia Solomko Date: Wed, 13 May 2026 17:10:46 +0300 Subject: T8492: CRL generated by VyOS PKI lacks X.509 extensions required for strongSwan validation Previously generated CRLs were missing the Authority Key Identifier and CRL Number extensions required by strongSwan for certificate revocation validation. Without these extensions, strongSwan silently ignores the CRL, allowing revoked certificates to authenticate successfully. The migration regenerates existing CRLs for all CAs that have a private key available. CAs with passphrase-protected keys are skipped with a warning, as the passphrase cannot be provided non-interactively --- interface-definitions/include/version/pki-version.xml.i | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 interface-definitions/include/version/pki-version.xml.i (limited to 'interface-definitions') diff --git a/interface-definitions/include/version/pki-version.xml.i b/interface-definitions/include/version/pki-version.xml.i new file mode 100644 index 000000000..874561368 --- /dev/null +++ b/interface-definitions/include/version/pki-version.xml.i @@ -0,0 +1,3 @@ + + + -- cgit v1.2.3