On Mon, 25 Jul 2016, jonetsu wrote: > Is there explicit Intermediate CA support in libreswan itself, or is it exclusively handled by NSS ? It is handled fully by NSS (as of libreswan v3.17) Older versions still had its own code to do some of the validation path. Paul