A connection between the subnets behind the gateways moon and sun is set up. The authentication is based on X.509 certificates which contain a critical but unsupported 'strongSwan' extension. Whereas moon ignores unsupported critical extensions by setting libstrongswan.x509.enforce_critical = no in strongswan.conf, sun discards such certificates and aborts the connection setup.