libreswan for Debian
--------------------

1) General Remarks

This package has been created by dkg with some reference/guidance from
previous packaging work by several other packagers of both libreswan
and other historical *swan projects (freeswan, openswan, etc).

2) openswan to libreswan migration

See:
* https://libreswan.org/wiki/Migrating_from_Openswan
* https://libreswan.org/wiki/Using_NSS_with_libreswan

2) Raw RSA key creation

Raw RSA keys can be generated with
    ipsec newhostkey

To display the key identifier of the key for use in leftrsasigkey/rightrsasigkey
in the "conn" section of ipsec.conf, use:
    ipsec showhostkey --left    (or --right)

For further information please take a closer look at the manpages
ipsec_rsasigkey, ipsec.secrets, ipsec_showhostkey and ipsec.conf.

3) X.509 support

All certificate material, including CA certificates, CRLs and private keys
are now stored in the NSS database in /etc/ipsec.d

When migrating from pre-NSS openswan, the files from /etc/ipsec.d/private,
/etc/ipsec.d/cacerts, /etc/ipsec.d/crls and /etc/ipsec.d/certs need to be
imported into NSS using certutil, crlutil or pk12util. For more information
see https://libreswan.org/wiki/Using_NSS_with_libreswan

4) IPsec Kernel Support

Note: This package uses the in-kernel IPsec stack, which is available
in all recent stock Debian kernel images.  This packaging does not
support KLIPS or KLIPS/MAST.

