The /etc/swanctl layout and setting up a CA, certificates and CRLs in strongSwan

In the previous article we looked at why swanctl is the preferred way to manage strongSwan. In this part we'll go through the /etc/swanctl directory layout and the basics of setting up a certificate authority (CA), certificates and certificate revocation lists (CRLs).

---

The /etc/swanctl directory layout

With swanctl, strongSwan follows a strict and predictable directory layout. By default, all files live in /etc/swanctl.

/etc/swanctl/
├── swanctl.conf
├── x509ca/
├── x509/
├── private/
└── x509crl/

Let's look at what each item is for.

swanctl.conf

The main swanctl configuration file.

It describes:

• VPN connections (connections)
• certificate authorities (authorities)
• secrets (secrets)
• address pools (pools)

The file is read by the swanctl utility and can be loaded into the running daemon without restarting it.

---

x509ca/ — certificate authority certificates

The directory for CA certificates (Root and Intermediate).

/etc/swanctl/x509ca/
└── ca-cert.pem

• Contains the public CA certificates
• Used to verify the chain of trust
• CA private keys are not stored here

---

x509/ — node certificates

The directory for the certificates of:

• the VPN server
• clients
• site-to-site peers

/etc/swanctl/x509/
├── vpn-server-cert.pem
└── vpn-client-cert.pem

These are the public certificates that match the private keys in private/.

---

private/ — private keys

The directory for private keys:

/etc/swanctl/private/
├── vpn-server-key.pem
└── vpn-client-key.pem

⚠️ Important:

• Access permissions must be restricted (600)
• The files are readable by root only
• CA private keys are usually kept outside this directory (offline)

---

x509crl/ — certificate revocation lists (CRLs)

The directory for Certificate Revocation Lists:

/etc/swanctl/x509crl/
└── ca-crl.pem

strongSwan uses the CRL to check:

• whether a certificate has been revoked
• whether it is valid at the moment the connection is established

---

Setting up a CA, certificates and CRLs — general principles

The certificate authority (CA)

In the context of strongSwan:

• the CA is used to sign server and client certificates
• strongSwan trusts the CA whose certificate is placed in x509ca/

The minimal set:

• CA certificate → /etc/swanctl/x509ca/
• CA CRL → /etc/swanctl/x509crl/

Server and client certificates

A VPN usually uses:

• a server certificate (IKE responder)
• client or peer certificates

Requirements:

• Key Usage and Extended Key Usage must be suitable for IKE
• the CN or SAN must match the settings in swanctl.conf

Placement:

• certificates → x509/
• private keys → private/

CRL (Certificate Revocation List)

A CRL is a mandatory element of a strict PKI model.

strongSwan:

• supports CRL checking
• loads CRLs via swanctl
• can check the CRL's validity period and the serial numbers of revoked certificates

The CRL file:

• must be in PEM format
• must be signed by the same CA that strongSwan trusts

Placement:

/etc/swanctl/x509crl/ca-crl.pem

---

Preparing the environment

Install the required packages:

sudo apt update
sudo apt install -y strongswan-pki

Create a working directory:

mkdir -p ~/pki/{ca,server,crl}
cd ~/pki

---

Creating the certificate authority (CA)

Generate the CA private key

pki --gen --type rsa --size 4096 --outform pem > ca/ca-key.pem
chmod 600 ca/ca-key.pem

Create the self-signed CA certificate

pki --self \
    --ca \
    --lifetime 3650 \
    --in ca/ca-key.pem \
    --type rsa \
    --dn "CN=VPN Root CA" \
    --outform pem > ca/ca-cert.pem

The result:

• ca-key.pem — the CA private key
• ca-cert.pem — the CA public certificate

📌 Only ca-cert.pem is copied to the strongSwan server

---

Generating the VPN server certificate

Generate the server private key

pki --gen --type rsa --size 4096 --outform pem > server/server-key.pem
chmod 600 server/server-key.pem

Create the server certificate

pki --pub --in server/server-key.pem --type rsa | \
    pki --issue --lifetime 1825 \
    --cacert ca/ca-cert.pem \
    --cakey ca/ca-key.pem \
    --dn "C=US, O=My Company, CN=vpn.example.com" \
    --san vpn.example.com \
    --san @vpn.example.com \
    --flag serverAuth --flag ikeIntermediate \
    --outform pem > server/server-cert.pem

Flags:

• serverAuth — allows the certificate to be used in the server role
• ikeIntermediate — recommended for IKEv2

---

Creating a Certificate Revocation List (CRL)

Generate the CRL

pki --signcrl \
    --cacert ca/ca-cert.pem \
    --cakey ca/ca-key.pem \
    --lifetime 30 \
    --outform pem > crl/ca-crl.pem

Parameters:

• --lifetime 30 — the CRL is valid for 30 days
• the CRL must be renewed regularly

---

Placing the files on the VPN server

Copy the files to /etc/swanctl:

/etc/swanctl/
├── x509ca/
│   └── ca-cert.pem
├── x509/
│   └── server-cert.pem
├── private/
│   └── server-key.pem
└── x509crl/
    └── ca-crl.pem

Access permissions:

chmod 600 /etc/swanctl/private/server-key.pem
chmod 644 /etc/swanctl/x509/*.pem
chmod 644 /etc/swanctl/x509ca/*.pem
chmod 644 /etc/swanctl/x509crl/*.pem

What's next?

1. Setting up a connection with EAP-MSCHAPV2 authentication
2. Setting up a connection with EAP-TLS authentication
3. Setting up a connection with both EAP-TLS and EAP-MSCHAPV2 authentication.