From 1af3c572eedb0eaddcdc5c9c41d98ff59bb7b2c9 Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Tue, 24 May 2016 17:11:11 +0200 Subject: IPSec: replace (self-signed) X.509 certs by their raw pubkey for authentication. There is no need to bother with X.509 cruft here. --- roles/common/templates/etc/ipsec.conf.j2 | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'roles/common/templates') diff --git a/roles/common/templates/etc/ipsec.conf.j2 b/roles/common/templates/etc/ipsec.conf.j2 index 4d6aa68..938f6b8 100644 --- a/roles/common/templates/etc/ipsec.conf.j2 +++ b/roles/common/templates/etc/ipsec.conf.j2 @@ -18,7 +18,8 @@ conn %default leftauth = pubkey left = %defaultroute leftsubnet = {{ ipsec[inventory_hostname_short] | ipv4 }}/32 - leftcert = {{ inventory_hostname_short }}.pem + leftid = {{ inventory_hostname }} + leftsigkey = {{ inventory_hostname_short }}.pem leftfirewall = yes lefthostaccess = yes rightauth = pubkey @@ -34,7 +35,7 @@ conn {{ hostvars[host].inventory_hostname_short }} {% if 'DynDNS' in hostvars[host].group_names %} rightallowany = yes {% endif %} - rightcert = {{ hostvars[host].inventory_hostname_short }}.pem + rightsigkey = {{ hostvars[host].inventory_hostname_short }}.pem rightsubnet = {{ ipsec[ hostvars[host].inventory_hostname_short ] | ipv4 }}/32 {% if 'NATed' not in group_names and 'NATed' in hostvars[host].group_names %} mobike = yes -- cgit v1.2.3