When using digital signature mode for authentication in an Hybrid IKE proposal, how does the VPN client confirm that any concentrator is the correct concentrator to connect to? As I have read the configuration documents, the client's only pieces of information are the DNS name/ip address of the concentrator that it is connecting to and the root certificate for the CA that issued the concentrator's cert. It seems to me that any device with a valid certificate issued from that CA could masquerade as a vaild concentrator because it digial signature would be correct. I understand how the signature validates the information signed with it, but how does digital signature mode insure that I am connecting to the right device? Does it do some matching based on the name within the certificate? Thanks in advance.
