# /etc/ipsec.conf - Libreswan IPsec configuration file

config setup
        logfile=/tmp/pluto.log
        logtime=no
        logappend=no
        plutodebug=all
        protostack=netkey

conn nss-cert-wrong
        left=%any
        leftsubnet=192.0.1.254/32
        leftid="E=testing@libreswan.org,CN=signedbyother.testing.libreswan.org,OU=Test Department,O=Libreswan,L=Toronto,ST=Ontario,C=CA"
        #leftid="C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=signedbyother.testing.libreswan.org, E=testing@libreswan.org"
        leftca="E=testing@libreswan.org,CN=Libreswan test CA for otherca,OU=Test Department,O=Libreswan,L=Toronto,ST=Ontario,C=CA"
        #leftca="C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for otherca, E=testing@libreswan.org"
        right=192.1.2.23
        rightid=%fromcert
        rightcert=east
        rightnexthop=192.1.2.45
        rightsubnet=192.0.2.254/32
        rightsourceip=192.0.2.254

conn nss-cert-correct
        left=%any
        leftsubnet=192.0.1.254/32
        leftid="C=CA, OU=*, CN=west.testing.libreswan.org, ST=*, L=Toronto, O=Libreswan, E=testing@libreswan.org"
        leftca="E=testing@libreswan.org,CN=Libreswan test CA for Mainca,OU=Test Department,L=Toronto,O=Libreswan,ST=Ontario,C=CA"
        #leftid="E=testing@libreswan.org,CN=west.testing.libreswan.org,OU=Test Department,O=Libreswan,L=Toronto,ST=Ontario,C=CA"
        right=192.1.2.23
        rightid=%fromcert
        rightcert=east
        rightnexthop=192.1.2.45
        rightsubnet=192.0.2.254/32
        rightsourceip=192.0.2.254
